CVE-2026-56123: socat SOCKS5 Heap Buffer Overflow (8.1 HIGH)

Technical summary

The vulnerability stems from a sign-extension error in the DOMAINNAME reply parser of socat's SOCKS5 implementation. The domain name length field is read into a signed char variable, and when this value is negative (high bit set), it undergoes implicit conversion to size_t for a heap write operation. This conversion produces a very large unsigned integer, causing an unbounded write to a 262-byte buffer. An attacker controlling a SOCKS5 proxy server can exploit this by sending a crafted response with a domain length byte interpreted as a negative signed value, triggering a heap-based buffer overflow that corrupts adjacent heap memory with attacker-supplied content.

Business impact

Organizations using socat as a proxy client or in network automation pipelines face risk of service disruption and potential code execution if their traffic is routed through compromised or attacker-controlled SOCKS5 proxies. This is particularly concerning in environments where socat bridges untrusted networks or where proxy infrastructure cannot be fully validated. Exploitation could lead to unauthorized access to systems running socat, data exfiltration, or lateral movement within connected networks.

Affected systems

The vulnerability affects socat versions 1.8.0.0 through 1.8.1.1 from dest-unreach. Any deployment using these versions to establish SOCKS5 connections is at risk, especially those relying on third-party or external proxy servers. Systems where socat runs with elevated privileges or handles sensitive data are of highest concern.

Exploitability

Exploitation requires that a victim's socat instance connect through an attacker-controlled or compromised SOCKS5 proxy server. The attack vector is network-based with no authentication required from the proxy perspective, but successful exploitation depends on the victim initiating a connection and the attacker being positioned to intercept or host the proxy endpoint. The CVSS vector reflects high complexity, suggesting the attack requires specific conditions but poses significant impact once achieved.

Remediation

Upgrade socat to a patched version released after 1.8.1.1. Verify the specific patched version number in the official dest-unreach advisory. Until patching is possible, restrict socat's use to trusted SOCKS5 proxies only, ideally those running on the same network segment with network controls in place. Consider replacing SOCKS5-based connections with alternative transport mechanisms where feasible.

Patch guidance

Check the dest-unreach project repository and advisory page for the next stable release after version 1.8.1.1. Apply patches to all instances of socat in production. Test patched versions in a staging environment before deploying to production, particularly in environments where socat is chained with other critical processes.

Detection guidance

Monitor for unusual memory access patterns or crashes of socat processes, particularly when connected to external SOCKS5 proxies. Inspect network traffic for DOMAINNAME replies in SOCKS5 handshakes with suspiciously large or negative length fields. Use memory sanitizers (ASan, MSan) in development and testing environments to catch heap corruption. Log all SOCKS5 proxy connections and validate that proxies are from approved, internal sources.

Why prioritize this

This vulnerability merits rapid attention due to its HIGH CVSS score (8.1), the potential for remote code execution, and the breadth of possible attack scenarios in networked environments. Although it requires an attacker to control or compromise a SOCKS5 proxy, the impact is severe. Organizations should prioritize patching production instances within one to two weeks, with higher urgency for systems exposed to untrusted networks.

Risk score, explained

The CVSS 3.1 score of 8.1 reflects high impact across confidentiality, integrity, and availability, combined with a network attack vector and no authentication requirement. The high complexity factor reflects the need for specific conditions (malicious proxy) rather than widespread exposure. This score appropriately captures the severity of heap corruption leading to potential code execution.

Frequently asked questions