Read the docs
TI-2026-65413 Aliases CVE-2026-102507GHSA-57xm-mfg7-58xm

Sliver 1.7.7 Denial of Service via PE Parser Slice Bounds in Operator RPC

Priority MEDIUM 63CWE-125Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-125 and the CVSS impact.

Summary

Sliver C2 framework version 1.7.7 and earlier contains an unhandled panic vulnerability in the operator gRPC handler that allows an attacker controlling a compromised implant to crash the entire teamserver by returning a malformed or empty Download response. Attackers can send zero-length or 1-3 byte data payloads through a hostile implant session to trigger an out-of-bounds slice access in the vendored Binject library's BinaryMagic function, which propagates unrecovered through the operator gRPC interceptor chain and terminates the server process, affecting all connected operators.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00184 8th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
BishopFoxsliver1.1.0 – 1.7.7—No fix listedCNA
  • sliver VendorBishopFox Affected 1.1.0 – 1.7.7 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:bishopfox:sliver:*:*:*:*:*:*:*:*——BishopFox
  • cpe:2.3:a:bishopfox:sliver:*:*:*:*:*:*:*:* Versions — — ·BishopFox

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-102507
  2. 2026-10-03 Alias added: GHSA-57xm-mfg7-58xm

References

Exploit 1

  • TI-2025-19960 Server-Side Request Forgery (SSRF) in sliver teamserver CVSS 4.0MEDIUM 6.9
  • TI-2023-17391 Sliver from v1.5.x to v1.5.39 has an improper cryptographic implementation, which allows… CVSS 3.1HIGH 8.1
  • TI-2024-27463 BishopFox Sliver Authenticated Remote Code Execution CVSS 3.1HIGH 7.2
  • TI-2025-19963 Sliver does not restricted traffic between Wireguard clients. CVSS 3.1MEDIUM 6.3
  • TI-2026-26522 Sliver One-Click Remote Access: Insecure CORS & Unauthenticated MCP Interface CVSS 4.0MEDIUM 5.9
  • TI-2026-25389 Sliver Vulnerable to Authenticated OOM via Memory Exhaustion in mTLS/WireGuard Transports CVSS 4.0MEDIUM 5.7
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences