CVE-2026-55777: Offset Used As Length Oob

A buffer offset is incorrectly reused as the length parameter in a memory copy operation. If this offset represents an index where a substring was found, it does not correspond to the remaining data length. This mismatch can result in reading beyond the end of the source buffer, leading to an out-of-bounds read and potential memory corruption. Calculate the

Provally CuratedPublic repositoryHighMedium confidenceVerifiedApache-2.0C
greprules fetch cve-2026-55777-offset-used-as-length-oob --engine opengrep

Description

A buffer offset is incorrectly reused as the length parameter in a memory copy operation. If this offset represents an index where a substring was found, it does not correspond to the remaining data length. This mismatch can result in reading beyond the end of the source buffer, leading to an out-of-bounds read and potential memory corruption. Calculate the