ANT-2026-19SGCVZZ · alembic

heap-buffer-overflow high

Severity Claude high · Security research firm high · Maintainer -

Discovered by Claude Mythos Preview

REPORT

Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits.

ANT-2026-19SGCVZZ: Heap buffer overflow in Ogawa ReadArraySample due to dimension/data size mismatch

A heap buffer overflow occurs in Ogawa's ReadArraySample when the declared array dimensions do not match the actual data size.

Target

Project: alembic
Location: ReadArraySample()
Discovery: static analysis — not yet dynamically reproduced

Technical Details

The root cause is a mismatch between the reported array dimensions and the size of the underlying data buffer in the Ogawa backend, which is not validated before the sample is read.

Reproduction

This finding was identified by static analysis and has not yet been dynamically reproduced. The Technical Details section above describes the code path; a trigger input is not included.

[No reproducer or sanitizer output attached — request from security-cvd@anthropic.com if needed.]

Acknowledgement

This vulnerability was discovered by Claude, Anthropic's AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research. Please direct questions to security-cvd@anthropic.com and reference ANT-2026-19SGCVZZ.

Reference: ANT-2026-19SGCVZZ
Anthropic CVD Policy: https://www.anthropic.com/coordinated-vulnerability-disclosure

SECURITY RESEARCH FIRM ANALYSIS

Triage and disclosure were performed by Trail of Bits. The writeup below is the document the firm sent to the maintainer.

Verdict: true positive
Severity: high

Address another fuzzer case when dimensions were specified to be much smaller than the data we have written out, this would cause a buffer overrun on the buffer we allocated for the data.

ADVISORY

https://github.com/alembic/alembic/commit/3f1745ae657b1ce79d39dc7a4bbc03441d2ebcd1

TIMELINE

Dates from discovery through public reveal.

2026-03-29 Reported to tracker
2026-05-07 Sent to maintainer
2026-05-07 Patch released
2026-05-07 Maintainer acknowledged
2026-07-20 Publicly revealed

PROVENANCE

SHA-3-512 hash:

5aa3b6575fe39265949155845e6648e367913759f4f78b4716cf4075bce110f72177b2c289f1f068ebbb2b4d14a4fc26b241a99c7457337a3b8cc5e7311dc50b

Committed 2026-05-07 00:00 PT

Revealed 2026-07-20 22:24 PT

Verify (download preimage.json)

Show preimage JSON

{
  "ant_id": "ANT-2026-19SGCVZZ",
  "bug_class": "Heap Buffer Overflow",
  "claude_severity": "high",
  "commit_sha": null,
  "created_at": "2026-03-29T20:42:37+00:00",
  "description": "A heap buffer overflow occurs in Ogawa's ReadArraySample when the declared array dimensions do not match the actual data size.",
  "discovered_at": null,
  "location": "ReadArraySample()",
  "poc_sha256": null,
  "preimage_version": 1,
  "project": "Alembic",
  "reproduction": null,
  "technical_details": "The root cause is a mismatch between the reported array dimensions and the size of the underlying data buffer in the Ogawa backend, which is not validated before the sample is read.",
  "title": "Heap buffer overflow in Ogawa ReadArraySample due to dimension/data size mismatch",
  "vendor_severity": "high"
}