ANT-2026-XKHM3P45 · nss

use-after-free low

Severity Claude critical · Security research firm low · Maintainer -

Discovered by Claude Mythos Preview

REPORT

Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Calif.

ANT-2026-XKHM3P45: Heap use-after-free in NSS DTLS client via crafted server response

The dtls-client-no_fuzzer_mode fuzz target triggers a heap-use-after-free READ in NSS while the client processes attacker-supplied DTLS server data. Because the no_fuzzer_mode variant runs with real cryptographic verification enabled, the faulting path is reachable through the normal client code path rather than a fuzzer-only shortcut. Freed heap memory is subsequently dereferenced during handshake or record processing. The specific freed object, allocation site, and faulting function are not present in this metadata and must be recovered from the attached ASAN trace.

Target

Project: nss
Commit: 348a2344fa5a5f33

Technical Details

ASAN reports a heap-use-after-free with operation READ. The DTLS client dereferences a pointer to heap memory that has already been freed while handling server-supplied input; the root cause (which object is freed early and which later access reads it) requires the full ASAN allocation/free/use stacks to determine.

Crash signature: ASAN heap-use-after-free READ in dtls-client-no_fuzzer_mode

Reproduction

Reproduce against the commit listed above as described under Technical Details.

[No reproducer or sanitizer output attached — request from security-cvd@anthropic.com if needed.]

Acknowledgement

This vulnerability was discovered by Claude, Anthropic's AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research. Please direct questions to security-cvd@anthropic.com and reference ANT-2026-XKHM3P45.

Reference: ANT-2026-XKHM3P45
Anthropic CVD Policy: https://www.anthropic.com/coordinated-vulnerability-disclosure

SECURITY RESEARCH FIRM ANALYSIS

Triage and disclosure were performed by Calif.

Verdict: true positive
Severity: low

TIMELINE

Dates from discovery through public reveal.

2026-03-26 Reported to tracker
2026-04-16 Patch released
2026-05-08 Sent to maintainer
2026-05-09 Maintainer acknowledged
2026-08-17 Publicly revealed

PROVENANCE

SHA-3-512 hash:

1302dfda8c1a1e94fab4103d732335c88318f9185c31ba171a2b7e9cc2421e0357b7fc2e836d7c822b50353e1c34a8612a22cc61ac7f5d9fd10b72d6a1060264

Committed 2026-05-08 00:10 PT

Revealed 2026-08-17 13:01 PT

Verify (download preimage.json)

Show preimage JSON

{
  "ant_id": "ANT-2026-XKHM3P45",
  "bug_class": "heap-use-after-free",
  "claude_severity": "critical",
  "commit_sha": "348a2344fa5a5f33",
  "created_at": "2026-03-27T02:05:26+00:00",
  "description": "The dtls-client-no_fuzzer_mode fuzz target triggers a heap-use-after-free READ in NSS while the client processes attacker-supplied DTLS server data. Because the no_fuzzer_mode variant runs with real cryptographic verification enabled, the faulting path is reachable through the normal client code path rather than a fuzzer-only shortcut. Freed heap memory is subsequently dereferenced during handshake or record processing. The specific freed object, allocation site, and faulting function are not present in this metadata and must be recovered from the attached ASAN trace.",
  "discovered_at": null,
  "location": null,
  "poc_sha256": null,
  "preimage_version": 1,
  "project": "nss",
  "reproduction": null,
  "technical_details": "ASAN reports a heap-use-after-free with operation READ. The DTLS client dereferences a pointer to heap memory that has already been freed while handling server-supplied input; the root cause (which object is freed early and which later access reads it) requires the full ASAN allocation/free/use stacks to determine.",
  "title": "Heap use-after-free in NSS DTLS client via crafted server response",
  "vendor_severity": "low"
}