inih CVE-2025-71450

Exploitation requires the host application to parse attacker-controlled INI input (file or string) using inih before r63, and the input must contain a line of at least INI_MAX_LINE-1 bytes immediately followed by an embedded NUL byte so that the overlong-line discard loop computes strlen(abyss)==0 and reads abyss[-1]. Limiting factors: the attack vector is local (AV:L) and demands passive user/application interaction (UI:P) to load the malicious INI data - there is no remote network trigger in the scored vector; privileges are not required (PR:N). Impact is bounded to a single out-of-bounds read producing undefined behavior/crash (VA:L), with no confidentiality or integrity effect, so the realistic consequence is limited to availability of the parsing process. The only complete fix per the vendor is updating to r63.

This is a genuinely low-priority issue despite the available patch and 'this_month' decision label. The supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L) scores only 4.8 (Medium), and every high-impact signal is absent: no confidentiality or integrity impact (VC:N/VI:N) and only low availability impact (VA:L). The flaw is a one-byte stack buffer under-read (CWE-127) reading abyss[-1] - it does not leak that byte to the attacker; it corrupts a comparison and manifests as undefined behavior typically caught by memory sanitizers, so the realistic worst case is misparsing or a crash, not data theft. No EPSS score and no KEV listing are present in the input, so exploitation status is 'no public exploit identified at time of analysis'; a public technical writeup (hackmd) and a VulnCheck advisory describe the flaw but are not verified working exploit code. The local attack vector (AV:L) plus required passive user interaction (UI:P - an application must parse attacker-supplied INI input) further limit real-world risk. Note one tension to verify: the tag labels this 'Information Disclosure,' but the CVSS vector sets VC:N and marks only availability (VA:L) impact, so the 'disclosure' framing is not supported by the scored impact.

An attacker supplies a crafted INI file or string to an application that embeds inih (before r63), containing a line of at least INI_MAX_LINE-1 bytes followed immediately by an embedded NUL byte. When ini_parse_stream() processes the overlong discarded line, strlen returns 0 and the code reads abyss[strlen(abyss)-1], i.e. abyss[-1], one byte before the buffer. A public writeup and VulnCheck advisory document the mechanism, but no confirmed working exploit code is provided; the practical outcome is undefined behavior or a crash rather than code execution or data disclosure.