CVE-2026-102360 lib0 二进制解码器越界读取漏洞
影响未认证远程攻击者可读取相邻进程内存，泄露敏感数据
lib0 的二进制解码器在 readUint8Array 中缺少边界检查，未将报文提供的长度与解码器自身视图进行比对。攻击者通过构造超长长度前缀，可读取宿主进程相邻内存并回传。该漏洞影响 0.2.1-0.2.117 及更早版本，以及 1.0.0-rc.32 及更早版本。
影响范围
lib0 0.2.1 至 0.2.117（含）及更早版本；1.0.0-rc.32 及更早版本。
漏洞详情
漏洞类型为越界读取（Out-of-bounds Read）。成因是 readUint8Array 未校验报文声明的长度是否超出解码器缓冲区范围，导致可读取相邻内存。任何能向 lib0 解码器提供字节的远程对端（包括认证前）均可触发，若消费方回显、存储或转发解码值，攻击者即可获取泄露数据。
利用条件与风险
利用无需认证，任何能建立套接字连接的对端均可触发。实战中可泄露其他租户文档内容、个人数据及实时 Bearer 会话令牌，风险较高。
修复建议
官方已在 0.2.118 和 1.0.0-rc.33 中修复，建议升级至上述版本或更高。临时缓解措施暂无公开信息。
A missing bounds check in the binary decoder in lib0, versions 0.2.1-0.2.117 and earlier and 1.0.0-rc.32 and earlier, lets any unauthenticated remote peer read adjacent process memory and receive it back. `readUint8Array` never compares the wire-supplied length against the decoder’s own view, so one over-long length prefix returns whatever the host process allocated next: other tenants’ document content, personal data, and live bearer session tokens**, recovered in full and at will. An attacker who can supply bytes to a lib0 decoder which means any peer that can open a socket, including before authentication reads adjacent process memory and, where the consumer echoes, stores or re-serves the decoded value, receives it back. This is patched in version 0.2.118 and 1.0.0-rc.33.