CVE-2026-58106: falha de baixa gravidade em Ericsson CodeChecker
Incomplete fix for CVE-2025-40843: safe_strcpy is called with PATH_MAX into fullPath+2, writing 2 bytes past the buffer on every CodeChecker log invocation
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
8Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 2epss 0.2%
CVE-2025-40843 https://github.com/advisories/GHSA-5xf2-f6ch-6p8r was fixed by replacing unchecked strcpy() with a bounded safe_strcpy() helper.
At ldlogger-tool-gcc.c:129 the destination passed to that helper is fullPath + 2, but the size
passed down is the full PATH_MAX. safe_strcpy() is strncpy(), which NUL-pads the
destination out to the whole n, so this site writes 4096 bytes into the 4094 that remain — a
2-byte stack overflow on every invocation, independent of the input path's length.
This issue affects CodeChecker: through 6.28.2.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:P/S:N/AU:Y/R:U/RE:L/U:Green
Produtos afetados
Ericsson · CodeCheckerCVEs relacionadas — Ericsson CodeChecker
No mesmo produto, das mais perigosas para as menos.
CVE-2024-10081CRITICALCVE-2024-10081EPSS 39.9%CVE-2024-10082HIGHCVE-2024-10082EPSS 0.5%CVE-2026-25660CRITICALAuthentication bypass for certain API callsEPSS 0.4%CVE-2026-58107MEDIUMAuthenticated Remote Denial of Service via Unbounded zlib Decompression in massStoreRunEPSS 0.4%CVE-2026-84161MEDIUMAuthenticated remote denial of service through unbounded zlib decompression in storeAnalysisStatisticsEPSS 0.3%CVE-2026-58108LOWPersonal access token delete filters on Session columns while deleting from PersonalAccessTokenDBEPSS 0.3%