CVE-2026-36189

Executive Summary

Technical Analysis

The vulnerability is a classic buffer overflow condition categorized under CWE-120. The root cause lies in improper bounds checking during memory copy or write operations within the parsing and tokenization phases of Uncrustify's code-processing pipeline. The affected functions—check_template (in check_template.cpp) and tokenize_cleanup—handle user-supplied source code input. When Uncrustify processes malformed or specially crafted input (e.g., deeply nested template structures, oversized token sequences, or unexpected character encodings), the check_template function fails to validate buffer boundaries before writing data.

Specifically, the check_template function is responsible for analyzing C++ template constructs (e.g., template<typename T> class Foo {...}). When Uncrustify encounters adversarial input that exploits weaknesses in template parsing logic, it may attempt to copy token data into a fixed-size stack or heap buffer without verifying the destination capacity, leading to memory corruption. The subsequent tokenize_cleanup function then attempts to free or dereference corrupted memory structures, triggering an access violation and terminating the process.

Attack Surface: The attack surface includes:

1. A local attacker with the ability to invoke uncrustify on a malicious file (e.g., via command line, IDE integration, or pre-commit hook).
2. Plugins or editors that auto-format files on save—if an attacker can inject a malicious file into a project, the IDE user's system is at risk.
3. CI/CD pipelines where uncrustify runs on untrusted code (e.g., pull requests from external contributors).

The vulnerability is local-only; no network attack vector is identified. However, the practical impact is significant in automated environments where a single malicious pull request can trigger a DoS on developer machines or build servers.

Exploitation Scenarios

Even without a public PoC or exploit code, a step-by-step attack chain can be reconstructed based on the vulnerability class and the affected functions.

Scenario: CI/CD Disruption via Malicious Pull Request

1. Reconnaissance / Target Identification: The attacker identifies an open-source project or enterprise repository that uses Uncrustify 0.82.0-132 in its CI pipeline (e.g., GitHub Actions, Jenkins) or recommends it in CONTRIBUTING.md. The attacker forks the repository and prepares a malicious source file.

2. Weaponization / Trigger: The attacker crafts a C++ source file that exercises the vulnerable check_template function. The payload would include:

   • A deeply nested or malformed template declaration, such as template<typename A, typename B, ...> with hundreds of parameters to force the parser to write beyond buffer limits.
   • Alternatively, a sequence of unterminated preprocessor directives (#if, #ifdef) combined with template code to create an inconsistent parser state.
   • The file is named to pass code-review filters (e.g., src/module.cpp) and embedded in the pull request.

3. Payload / Execution: The attacker submits the pull request. The CI system automatically runs uncrustify --check (or similar) against the modified source file. When the formatter processes the malicious file, the check_template function overflows a buffer, causing a crash. The CI job fails with a segmentation fault or abort.

4. Post-Exploitation Impact: The CI pipeline becomes unreliable. If the crash is persistent (every run of the formatter on the same file triggers it), the attacker can repeatedly block builds, delaying releases. In a more targeted scenario, if Uncrustify runs as part of a privileged service (e.g., a code-security scanner with elevated permissions), the crash could lead to a more severe memory-corruption primitive, potentially enabling arbitrary code execution in subsequent exploitation stages—though no such escalation has been publicly demonstrated for this CVE.

Scenario: Developer Workstation DoS via IDE Integration

1. An attacker distributes a malicious code snippet (e.g., via a pastebin link or a poisoned library) that triggers the overflow when a developer runs Uncrustify through an IDE plugin (e.g., VS Code C++ formatter extensions).
2. The IDE crashes or the formatter process is terminated, requiring the developer to manually fix or disable the plugin, wasting time and potentially corrupting the currently open file.

Impact Assessment

Business Impact: Uncrustify is a development tool, not a production service. Therefore, the direct business impact is disruption to software development workflows rather than data breach or system compromise. However, in enterprise environments with centralized build systems, this DoS can halt releases, delay feature delivery, and tie up engineering resources.

Affected Systems: Development workstations, CI/CD servers, and any automated code-formatting service that leverages Uncrustify version 0.82.0-132.

Blast Radius: Low-to-medium. The vulnerability is local-only and requires the ability to feed malicious input to the formatter. While the CVSS score is authoritatively listed as N/A, the nature of the flaw (memory corruption leading to DoS) would typically rate in the Medium range (CVSS ~5.5 under AV:L/PR:L/UI:R) if scored properly: low attack complexity, no integrity/confidentiality impact, limited availability impact.

CISA KEV Status: Not listed in CISA's Known Exploited Vulnerabilities catalog, indicating no confirmed exploitation in the wild as of the compilation date of this report.

EPSS Analysis: The EPSS score of 0.00134 (3.3rd percentile) confirms very low exploitation probability, consistent with a local DoS vulnerability in a niche developer tool.

Detection Guidance

Detection of this vulnerability involves monitoring for abnormal crashes or memory-corruption events within Uncrustify processes, as well as network-level signatures if the tool is exposed via a web service (unlikely but possible in dev-tool SaaS platforms).

Sigma Rule

The following Sigma rule detects Uncrustify crashes triggered by malformed template input on Windows and Linux systems.

title: Uncrustify Buffer Overflow Crash Detection
id: 63a12b3e-5c9c-4e2b-bc11-7c1e37d5f6e8
status: experimental
description: Detects Uncrustify process crashes indicating potential exploitation of CVE-2026-36189
author: ValtersIT Threat Intelligence
date: 2026/01/15
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\uncrustify.exe'
        CommandLine|contains:
            - '.cpp'
            - '.hpp'
            - '.cxx'
    condition: selection and (EventID: 1 or EventID: 4688)
falsepositives:
    - Legitimate crashes due to malformed input in development
level: medium
tags:
    - attack.t1499
    - cve.2026.36189

Linux variant (using Sysmon for Linux or auditd):

title: Uncrustify Buffer Overflow Crash Detection (Linux)
id: 63a12b3e-5c9c-4e2b-bc11-7c1e37d5f6e9
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        exe: '/usr/bin/uncrustify'
        exit_code:
            - 139  # SIGSEGV
            - 134  # SIGABRT
    condition: selection
falsepositives:
    - Known bugs in Uncrustify unrelated to CVE
level: medium

YARA Rule

This YARA rule scans for strings commonly associated with the vulnerable Uncrustify version or identifier patterns.

rule uncrustify_cve_2026_36189 {
    meta:
        author = "ValtersIT Threat Intelligence"
        description = "Detects Uncrustify binaries and related artifacts potentially vulnerable to CVE-2026-36189"
        revision = "1"
        date = "2026-01-15"
    strings:
        $version_string = /Uncrustify_d-0\.82\.0-132/
        $error_pattern = /buffer overflow/ nocase
        $src_pattern = "check_template.cpp"
        $func_pattern = "tokenize_cleanup"
    condition:
        uint16(0) == 0x457f  // ELF magic
        and ($version_string or $src_pattern) or ($func_pattern and $error_pattern)
}

Suricata IDS Rule

Given that this is a local-only vulnerability, network-based detection is limited. However, if Uncrustify is exposed via a web-based code-formatting API, this rule can capture malicious payloads.

alert tcp any any -> any any (msg:"CVE-2026-36189 Uncrustify Buffer Overflow Malicious Input"; flow:established,to_server; content:"template<typename"; nocase; depth:100; pcre:"/template\s*<\s*typename\s+[A-Za-z0-9_]+\s*,/"; classtype:attempted-dos; sid:202636189; rev:1; reference:cve,2026-36189;)

Elastic Detection

EQL query for detecting repeated Uncrustify crashes within a short window, indicating a possible ongoing DoS attempt.

sequence by process.entity_id with maxspan=5m
  [ process where process.name == "uncrustify" and event.action == "executed" ]
  [ process where process.name == "uncrustify" and process.exit_code >= 128 ]

Splunk SPL Query

index=win-event OR index=linux-sysmon earliest=-24h
| search process_name=uncrustify (exit_code=139 OR exit_code=134 OR exit_code=3221226356)
| stats count by host, user, command_line
| where count > 3
| table _time, host, user, command_line, count

Wazuh OSSEC Rule

<group name="uncrustify,">
  <rule id="100350" level="7">
    <if_sid>5715,5716,5717</if_sid> <!-- process termination rules -->
    <match>uncrustify</match>
    <description>Uncrustify crashed - possible CVE-2026-36189 exploitation</description>
    <group>local_dos,</group>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

1) Immediate Mitigations:

• Restrict the ability to run uncrustify on untrusted files. Remove Uncrustify from CI pipelines that process external/third-party contributions unless the fix commit is applied.
• Use a sandbox or containerized environment (e.g., Docker with seccomp, gVisor) when invoking Uncrustify on untrusted input to contain the impact of a crash.
• Configure memory-protection hardening: compile Uncrustify with stack-protector (-fstack-protector-strong), AddressSanitizer (-fsanitize=address) for development/debug builds, and FORTIFY_SOURCE.
• For IDE users, disable auto-formatting on save if the integrated Uncrustify version is unpatched.

2) Patch/Upgrade Steps:

• Monitor the Uncrustify release page (https://github.com/uncrustify/uncrustify/releases) for an official release containing the fix. Upgrade to the patched version (e.g., 0.83.0 when available).
• For Debian/Ubuntu users: check for updated packages via apt-cache policy uncrustify and apply any security updates. If unavailable, build from source with the fix commit.
• For package managers (choose the correct one for your OS — none of the listed entries apply to Uncrustify's distribution model, which uses Git and native package repos; use apt, yum, brew, vcpkg, or direct compile):
  • macOS: brew upgrade uncrustify
  • Debian/Ubuntu: sudo apt update && sudo apt install --only-upgrade uncrustify
  • RHEL/Fedora: sudo dnf upgrade uncrustify

3) Long-Term Hardening:

• Implement a security review process for developer tools: subscribe to U-CERT or project-specific security advisories.
• Add input sanitization/validation: if Uncrustify is wrapped in a service, apply file-size limits and template-complexity checks before processing.
• In CI pipelines, run Uncrustify in an isolated ephemeral container with limited privileges and no network access.
• Enforce code-review requirements for any change to build tooling, including formatter versions.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-36189
2. Uncrustify Releases (for patched version tracking): https://github.com/uncrustify/uncrustify/releases
3. MITRE ATT&CK Technique T1499: https://attack.mitre.org/techniques/T1499/

Known Threat Actor Activity: There is no evidence of exploitation in the wild, no CISA KEV inclusion, and no known threat actor campaigns associated with CVE-2026-36189 at the time of writing. The EPSS percentile (3.3%) corroborates this low immediate threat level.