CodeChecker CVE-2025-40843

Exploitation requires local ability to execute the 'CodeChecker log' command with attacker-controlled input - specifically a crafted overlong compilation path/argument that is copied via unchecked strcpy() into a fixed 4096-byte stack buffer in the internal ldlogger library; the public PoC also sets the CC_LOGGER_DEF_DIRS=1 environment variable. The key limiting factor is that only environments where 'CodeChecker log' processes untrusted or externally-influenced input (e.g., shared CI runners or automated build pipelines ingesting user-supplied paths) are realistically at risk; the local attack vector (AV:L) and required low-privilege execution (PR:L) mean a purely isolated developer workstation running trusted builds faces minimal exposure. Affected versions are CodeChecker through 6.26.1; fixed in 6.26.2.

This is a moderate-priority, high-CVSS-but-low-real-world-urgency issue when judged across all signals. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a locally-exploitable stack buffer overflow (CWE-121) requiring low privileges and no user interaction, with full confidentiality/integrity/availability impact consistent with arbitrary code execution in the context of the user running the tool. The EPSS score is very low (0.19%, 8th percentile), indicating no meaningful signal of broad opportunistic exploitation, and the CVE is NOT on CISA KEV, so there is no evidence of active exploitation. A proof-of-concept is publicly available (the GHSA advisory includes a working bash PoC), so publicly available exploit code exists - but this is distinct from active exploitation and does not change the local-only attack surface. No SSVC decision data was provided in the input. The signals are internally consistent: the local attack vector (AV:L) plus low EPSS plus absence from KEV all point to a developer-tooling flaw that is only dangerous where the vulnerable 'CodeChecker log' command processes attacker-influenced input, rather than a remotely-exploitable, mass-targeted vulnerability. Real priority is driven by context: environments that pipe untrusted/user-controlled paths or build commands into 'CodeChecker log' (e.g., shared CI runners) should patch promptly; isolated developer workstations face limited realistic risk.

In a shared CI/build environment, an attacker who can influence the arguments or environment passed to the 'CodeChecker log' command supplies a crafted overlong file path (the public PoC uses ~4090 'A' characters with CC_LOGGER_DEF_DIRS=1) that overruns a fixed 4096-byte stack buffer via an unchecked strcpy() in the internal ldlogger library. Because this requires local execution with low privileges (AV:L/PR:L) and no user interaction, exploitation yields code execution in the context of the process running the log command. A working proof-of-concept is publicly available in the GHSA advisory.