ANT-2026-8HYRCFKW · duckdb

heap-buffer-overflow medium

Severity Claude medium · Security research firm medium · Maintainer -

Discovered by Claude Mythos Preview

REPORT

Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits.

ANT-2026-8HYRCFKW: Integer overflow to heap buffer overflow in list_resize() via UBIGINT wrap-around

An integer overflow caused by UBIGINT wrap-around in list_resize() results in a heap buffer overflow.

Target

Project: duckdb
Location: list_resize()
Discovery: static analysis — not yet dynamically reproduced

Technical Details

The size value for the result is computed via an addition that is not checked for integer overflow; on wraparound the allocated buffer is smaller than the data actually written, yielding a heap out-of-bounds write.

Reproduction

This finding was identified by static analysis and has not yet been dynamically reproduced. The Technical Details section above describes the code path; a trigger input is not included.

[No reproducer or sanitizer output attached — request from security-cvd@anthropic.com if needed.]

Acknowledgement

This vulnerability was discovered by Claude, Anthropic's AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research. Please direct questions to security-cvd@anthropic.com and reference ANT-2026-8HYRCFKW.

Reference: ANT-2026-8HYRCFKW
Anthropic CVD Policy: https://www.anthropic.com/coordinated-vulnerability-disclosure

SECURITY RESEARCH FIRM ANALYSIS

Triage and disclosure were performed by Trail of Bits. The writeup below is the document the firm sent to the maintainer.

Verdict: true positive
Severity: medium

list_resize computes a size for the result, but this length could overflow, leading to a too small allocation and subsequent out-of-bounds write. This PR fixes this using a checked addition.

Credits for finding this to Trail of Bits / David Pokora (@Xenomega) / Anthropic

TIMELINE

Dates from discovery through public reveal.

2026-03-29 Reported to tracker
2026-05-07 Sent to maintainer
2026-05-07 Patch released
2026-05-07 Maintainer acknowledged
2026-08-17 Publicly revealed

PROVENANCE

SHA-3-512 hash:

f880ca8b6b46fa9fe680682d8eb48d5e8ff9883c1f4bbc5f550b2f827fe83782c8a8bf950cbfb25d6fcc15556934ad541d18287922b396b0d728db040a6fe431

Committed 2026-05-07 00:00 PT

Revealed 2026-08-17 10:47 PT

Verify (download preimage.json)

Show preimage JSON

{
  "ant_id": "ANT-2026-8HYRCFKW",
  "bug_class": "Heap Buffer Overflow",
  "claude_severity": "medium",
  "commit_sha": null,
  "created_at": "2026-03-29T20:42:44+00:00",
  "description": "An integer overflow caused by UBIGINT wrap-around in list_resize() results in a heap buffer overflow.",
  "discovered_at": null,
  "location": "list_resize()",
  "poc_sha256": null,
  "preimage_version": 1,
  "project": "DuckDB",
  "reproduction": null,
  "technical_details": "The size value for the result is computed via an addition that is not checked for integer overflow; on wraparound the allocated buffer is smaller than the data actually written, yielding a heap out-of-bounds write.",
  "title": "Integer overflow to heap buffer overflow in list_resize() via UBIGINT wrap-around",
  "vendor_severity": "medium"
}