Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Sliver is a command and control framework that uses a custom Wireguard netstack. Versions 1.7.3 and below contain a Remote OOM (Out-of-Memory) vulnerability in the Sliver C2 server's mTLS and WireGuard C2 transport layer. The socketReadEnvelope and socketWGReadEnvelope functions trust an attacker-controlled 4-byte length prefix to allocate memory, with ServerMaxMessageSize allowing single allocations of up to ~2 GiB. A compromised implant or an attacker with valid credentials can exploit this by sending fabricated length prefixes over concurrent yamux streams (up to 128 per connection), forcing the server to attempt allocating ~256 GiB of memory and triggering an OS OOM kill. This crashes the Sliver server, disrupts all active implant sessions, and may degrade or kill other processes sharing the same host. The same pattern also affects all implant-side readers, which have no upper-bound check at all. The issue was not fixed at the the time of publication.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-18 | 1 | General1 |
| 2026-03-20 | 3 | Disclosure3 |
| 2026-03-24 | 1 | Disclosure1 |
🚨 2 Zero-Days in Sliver C2 (CVE-2026-29781 | CVE-2026-32941) https://skoveit.github.io/skoving/writeups/C2/Sliver-UnoReverse/
Post summary
A brief notice identifies two zero-day CVEs in Sliver C2 but provides no concrete details, PoC, or evidence of exploitation.
CVE-2026-32941 Sliver is a command and control framework that uses a custom Wireguard netstack. Versions 1.7.3 and below contain a Remote OOM (Out-of-Memory) vulnerability in the Sl… https://www.cve.org/CVERecord?id=CVE-2026-32941
Post summary
CVE-2026-32941 is a Remote OOM vulnerability in Sliver versions 1.7.3 and earlier due to a custom Wireguard netstack; no PoC, exploit, patch, or active exploitation evidence is mentioned.
🔴 Sliver, Remote OOM, #CVE-2026-32941 (Critical) https://dailycve.com/sliver-remote-oom-cve-2026-32941-critical/
Post summary
The post reports the discovery of CVE-2026-32941, a remote out‑of‑bounds memory leak affecting Sliver, marked as Critical.
CVE-2026-32941 Remote Out-of-Memory Vulnerability in Sliver C2 Framework Versions 1.7.3 and Below https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-32941
Post summary
The post announces a remote out‑of‑memory issue affecting Sliver C2 Framework versions 1.7.3 and earlier, providing a link to a vulnerability detail page.
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-32941 - Sliver Vulnerable to Authenticated OOM via Memory Exhaustion in mTLS/WireGuard Transports Intel Report: https://ift.tt/1ASWBcm
Post summary
Alert describing CVE‑2026‑32941, noting an authenticated OOM vulnerability in Sliver’s mTLS/WireGuard transports, with no evidence of active exploitation or PoC provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | bishopfox | sliver | - | - | - |