CVE-2008-3196

FAUCET Score

CVE-2008-3196 describes an out-of-bounds stack access vulnerability in yacc's skeleton.c when handling rules with an empty right-hand side. This critical vulnerability (CVSS 7.8) allows unauthenticated, context-dependent attackers to cause a denial of service. Despite its severity, there is no known active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		All Versions ImpactedCPE matchmatch criteria	cpe:2.3:a:yacc:yacc::::::::

CVSS Data

CVSS version used by this source: 2.0

7.8HIGH

AV:N/AC:L/Au:N/C:N/I:N/A:C

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Exploitability Score

10.0

Impact Score

6.9

CvssVersion

2.0

Exploit Intelligence

EPSS Score

1.45%

Probability of exploitation in next 30 days

EPSS Percentile

70.6%

Percentile rank of EPSS score among Peer Group

As of 2026-07-24

Model: v2026.06.15

This CVE's current EPSS score of 0.0145 is in the 52nd percentile among its peer group of 51,466 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Vendor Patches (2)

redhatend of lifevia redhat_api

Product: Red Hat Enterprise Linux 4Fixed in: byacc

redhatend of lifevia redhat_api

Product: Red Hat Enterprise Linux 5Fixed in: byacc

Vendor Advisories (1)

redhatCVE-2008-3196Low

byacc: Potential out of bounds of allocated stack access

Jul 8, 2008

References

marc.info

secunia.com / advisories/31073

vupen.com / english/advisories/2008/2151/references