ID:12944 - Exploit for Heap-based buffer overflow in NGINX Plus and NGINX Open Source - CVE-2026-9256

Vulnerability identifier: #VU132220

Vulnerability risk: Critical

CVE-ID: CVE-2026-9256

CWE-ID: CWE-122

Exploitation vector: Remote access

Vulnerable software:
NGINX Plus
NGINX Open Source
Gentoo Linux
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15 SP6
Debian Linux
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Real Time 15
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Ubuntu
Server Applications Module
openSUSE Leap
openEuler
Anolis OS
Fedora
nginx-mod-js-challenge
nginx-mod-vts
nginx-mod-fancyindex
nginx-mod-headers-more
nginx-mod-brotli
nginx-mod-modsecurity
nginx (Ubuntu package)
nginx-mod-naxsi
nginx (Red Hat package)
nginx-help
nginx-mod-mail
nginx-mod-http-xslt-filter
nginx-mod-http-perl
nginx-mod-http-image-filter
nginx-mod-devel
nginx-debugsource
nginx-debuginfo
nginx
nginx-mod-stream
nginx-all-modules
nginx-filesystem
nginx-source
nginx (Debian package)
nginx-core
nginx-doc
www-servers/nginx

https://github.com/NebuSec/CyberMeowfia

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to heap-based buffer overflow in ngx_http_rewrite_module when processing crafted HTTP requests that trigger rewrite directives using overlapping PCRE captures and multiple capture references in a redirect or arguments context. A remote attacker can send crafted HTTP requests to execute arbitrary code or crash the web server.

There is no control plane exposure; this is a data plane issue only. Code execution is possible on systems with ASLR disabled or when ASLR can be bypassed.

Install security update from vendor's website.