MEDIUM
happyfish100 libfastcommon base64.c base64_decode stack-based overflow
Published Feb 6, 2026
4.8
MEDIUMCVSS 4.0
EPSS 0.27%
Description
A security vulnerability has been detected in happyfish100 libfastcommon up to 1.0.84. Affected by this vulnerability is the function base64_decode of the file src/base64.c. The manipulation leads to stack-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used. The identifier of the patch is 82f66af3e252e3e137dba0c3891570f085e79adf. Applying a patch is the recommended action to fix this issue.
Affected products
-
- Version 1.0.0StatusaffectedConstraints-
- Version 1.0.1StatusaffectedConstraints-
- Version 1.0.10StatusaffectedConstraints-
- Version 1.0.11StatusaffectedConstraints-
- Version 1.0.12StatusaffectedConstraints-
- Version 1.0.13StatusaffectedConstraints-
- Version 1.0.14StatusaffectedConstraints-
- Version 1.0.15StatusaffectedConstraints-
- Version 1.0.16StatusaffectedConstraints-
- Version 1.0.17StatusaffectedConstraints-
- Version 1.0.18StatusaffectedConstraints-
- Version 1.0.19StatusaffectedConstraints-
- Version 1.0.2StatusaffectedConstraints-
- Version 1.0.20StatusaffectedConstraints-
- Version 1.0.21StatusaffectedConstraints-
- Version 1.0.22StatusaffectedConstraints-
- Version 1.0.23StatusaffectedConstraints-
- Version 1.0.24StatusaffectedConstraints-
- Version 1.0.25StatusaffectedConstraints-
- Version 1.0.26StatusaffectedConstraints-
- Version 1.0.27StatusaffectedConstraints-
- Version 1.0.28StatusaffectedConstraints-
- Version 1.0.29StatusaffectedConstraints-
- Version 1.0.3StatusaffectedConstraints-
- Version 1.0.30StatusaffectedConstraints-
- Version 1.0.31StatusaffectedConstraints-
- Version 1.0.32StatusaffectedConstraints-
- Version 1.0.33StatusaffectedConstraints-
- Version 1.0.34StatusaffectedConstraints-
- Version 1.0.35StatusaffectedConstraints-
- Version 1.0.36StatusaffectedConstraints-
- Version 1.0.37StatusaffectedConstraints-
- Version 1.0.38StatusaffectedConstraints-
- Version 1.0.39StatusaffectedConstraints-
- Version 1.0.4StatusaffectedConstraints-
- Version 1.0.40StatusaffectedConstraints-
- Version 1.0.41StatusaffectedConstraints-
- Version 1.0.42StatusaffectedConstraints-
- Version 1.0.43StatusaffectedConstraints-
- Version 1.0.44StatusaffectedConstraints-
- Version 1.0.45StatusaffectedConstraints-
- Version 1.0.46StatusaffectedConstraints-
- Version 1.0.47StatusaffectedConstraints-
- Version 1.0.48StatusaffectedConstraints-
- Version 1.0.49StatusaffectedConstraints-
- Version 1.0.5StatusaffectedConstraints-
- Version 1.0.50StatusaffectedConstraints-
- Version 1.0.51StatusaffectedConstraints-
- Version 1.0.52StatusaffectedConstraints-
- Version 1.0.53StatusaffectedConstraints-
- Version 1.0.54StatusaffectedConstraints-
- Version 1.0.55StatusaffectedConstraints-
- Version 1.0.56StatusaffectedConstraints-
- Version 1.0.57StatusaffectedConstraints-
- Version 1.0.58StatusaffectedConstraints-
- Version 1.0.59StatusaffectedConstraints-
- Version 1.0.6StatusaffectedConstraints-
- Version 1.0.60StatusaffectedConstraints-
- Version 1.0.61StatusaffectedConstraints-
- Version 1.0.62StatusaffectedConstraints-
- Version 1.0.63StatusaffectedConstraints-
- Version 1.0.64StatusaffectedConstraints-
- Version 1.0.65StatusaffectedConstraints-
- Version 1.0.66StatusaffectedConstraints-
- Version 1.0.67StatusaffectedConstraints-
- Version 1.0.68StatusaffectedConstraints-
- Version 1.0.69StatusaffectedConstraints-
- Version 1.0.7StatusaffectedConstraints-
- Version 1.0.70StatusaffectedConstraints-
- Version 1.0.71StatusaffectedConstraints-
- Version 1.0.72StatusaffectedConstraints-
- Version 1.0.73StatusaffectedConstraints-
- Version 1.0.74StatusaffectedConstraints-
- Version 1.0.75StatusaffectedConstraints-
- Version 1.0.76StatusaffectedConstraints-
- Version 1.0.77StatusaffectedConstraints-
- Version 1.0.78StatusaffectedConstraints-
- Version 1.0.79StatusaffectedConstraints-
- Version 1.0.8StatusaffectedConstraints-
- Version 1.0.80StatusaffectedConstraints-
- Version 1.0.81StatusaffectedConstraints-
- Version 1.0.82StatusaffectedConstraints-
- Version 1.0.83StatusaffectedConstraints-
- Version 1.0.84StatusaffectedConstraints-
- Version 1.0.9StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Happyfish100 | Libfastcommon | n/a |
|
- ≤ 1.0.84
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Metrics
4.8 MEDIUM CVE.org
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Attack Vector Local
Attack Complexity Low
Attack Requirements None
Privileges Required Low
User Interaction None
Vulnerable System Confidentiality Low
Vulnerable System Integrity Low
Vulnerable System Availability Low
Subsequent System Confidentiality None
Subsequent System Integrity None
Subsequent System Availability None
Exploit Maturity Proof of Concept
1 other source (NVD) ▾
1.9 LOW NVD
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Local
Attack Complexity Low
Attack Requirements None
Privileges Required Low
User Interaction None
Vulnerable System Confidentiality Low
Vulnerable System Integrity Low
Vulnerable System Availability Low
Subsequent System Confidentiality None
Subsequent System Integrity None
Subsequent System Availability None
Exploit Maturity Proof of Concept
Confidentiality Requirement n/a
Integrity Requirement n/a
Availability Requirement n/a
Scope n/a
7.8 HIGH NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality Impact High
Integrity Impact High
Availability Impact High
1 other source (CVE.org) ▾
5.3 MEDIUM CVE.org
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality Impact Low
Integrity Impact Low
Availability Impact Low
Exploit Maturity Proof of Concept
5.3 MEDIUM CVE.org
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality Impact Low
Integrity Impact Low
Availability Impact Low
Exploit Maturity Proof of Concept
4.3 MEDIUM CVE.org
AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C
Access Vector Local
Access Complexity Low
Authentication Single
Confidentiality Impact Partial
Integrity Impact Partial
Availability Impact Partial
Exploit Maturity POC
1 other source (NVD) ▾
4.3 MEDIUM NVD
AV:L/AC:L/Au:S/C:P/I:P/A:P
Access Vector Local
Access Complexity Low
Authentication Single
Confidentiality Impact Partial
Integrity Impact Partial
Availability Impact Partial
This CVE is not in the KEV list.
CISA SSVC (Vulnrichment)
Stakeholder-Specific Vulnerability Categorization from CISA ADP.
Exploitation
NoneAutomatable
NoTechnical Impact
PartialDecision
n/aAssessed Feb 6, 2026 · SSVC 2.0.3
0.27% 0.00275
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
EPSS probability 0.00275
Score over time
Feb–Oct 2026- EPSS v4
- EPSS v5
Percentile over time
- EPSS v4
- EPSS v5
Table of values (3 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 0.27% (0.00275) | 18.01th | v5 (v2026.06.15) |
| Jun 15, 2026 | 0.26% (0.00259) | 16.98th | v5 (v2026.06.15) |
| Feb 6, 2026 | 0.01% (0.00013) | 1.68th | v4 (v2025.03.14) |
Weaknesses (3)
References (8)
- https://github.com/happyfish100/libfastcommon/ product
- https://github.com/happyfish100/libfastcommon/commit/82f66af3e252e3e137dba0c3891570f085e79adf patch
- https://github.com/happyfish100/libfastcommon/issues/55 issue-trackingExploitVendor Advisory
- https://github.com/happyfish100/libfastcommon/issues/55#issue-3836362577 exploitissue-trackingVendor Advisory
- https://github.com/happyfish100/libfastcommon/issues/55#issuecomment-3776757848 issue-trackingExploitVendor Advisory
- https://vuldb.com/?ctiid.344598 signaturepermissions-requiredPermissions RequiredVDB Entry
- https://vuldb.com/?id.344598 vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
- https://vuldb.com/?submit.743873 third-party-advisoryThird Party AdvisoryVDB Entry
| Link | Providers | Tags |
|---|---|---|
| https://github.com/happyfish100/libfastcommon/ | product | |
| https://github.com/happyfish100/libfastcommon/commit/82f66af3e252e3e137dba0c3891570f085e79adf | patch | |
| https://github.com/happyfish100/libfastcommon/issues/55 | issue-trackingExploitVendor Advisory | |
| https://github.com/happyfish100/libfastcommon/issues/55#issue-3836362577 | exploitissue-trackingVendor Advisory | |
| https://github.com/happyfish100/libfastcommon/issues/55#issuecomment-3776757848 | issue-trackingExploitVendor Advisory | |
| https://vuldb.com/?ctiid.344598 | signaturepermissions-requiredPermissions RequiredVDB Entry | |
| https://vuldb.com/?id.344598 | vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry | |
| https://vuldb.com/?submit.743873 | third-party-advisoryThird Party AdvisoryVDB Entry |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner VulDB
Published Feb 6, 2026
Updated Feb 23, 2026
Reserved Feb 5, 2026
Link CVE-2026-2016
CISA Vulnrichment
Updated Feb 6, 2026