Severity by source
Local vector assumed as path supply is typically local; AC:H because MAX_PATH boundary conditions require precise path crafting; full CIA impact for stack overflow with code execution potential.
Lifecycle Timeline
2DescriptionCVE.org
[opendir() stack overflow via wcscat on MAX_PATH path]
AnalysisAI
Stack-based buffer overflow in the opendir() implementation triggered via unbounded wcscat() concatenation when processing paths at or near the MAX_PATH boundary. Callers supplying a crafted, maximally-long wide-character directory path can overflow a stack buffer, potentially leading to memory corruption, denial of service via crash, or - depending on stack layout and mitigations - arbitrary code execution. Ubuntu has reported this as a vendor-tracked issue; exploitation conditions and patch availability are not yet fully confirmed from available data.
Technical ContextAI
The vulnerability resides in the opendir() POSIX function implementation, likely within glibc or a platform-specific filesystem abstraction layer on Ubuntu Linux. The root cause is an unsafe use of wcscat() - the wide-character (wchar_t) string concatenation function - to build or extend a directory path that can reach MAX_PATH in length. Unlike mbscpy/strcat equivalents, wcscat() performs no bounds checking; if the destination buffer is sized to exactly MAX_PATH wide characters but the concatenation of path components exceeds that boundary, the excess bytes overflow into adjacent stack frames. The CWE is not formally assigned in the available data, but this is a canonical CWE-121 (Stack-based Buffer Overflow), a subclass of CWE-787 (Out-of-bounds Write). The MAX_PATH boundary condition suggests the triggering path requires a filename or directory structure at or near 260 or 4096 characters depending on the filesystem and compile-time constant used.
Affected ProductsAI
The affected product is the opendir() implementation as shipped in Ubuntu Linux, reported by Ubuntu as a vendor-tracked issue. Exact affected Ubuntu releases, glibc versions, and CPE strings are not provided in the available intelligence. No NVD CPE data is present. The specific library or binary containing the vulnerable wcscat call (e.g., glibc, a filesystem utility, or a userspace daemon) is not named in the available data. Consumers should monitor Ubuntu Security Notices (USN) for the precise package name and affected version range.
RemediationAI
No vendor-released patch or advisory URL is available in the provided data at time of analysis. As a compensating control, operators should restrict the ability of untrusted users or processes to supply arbitrarily long directory paths to opendir()-invoking code. Where opendir() is called on attacker-influenced input (e.g., in FTP daemons, file managers, or web services), enforce strict path length validation before the call, rejecting inputs at or approaching MAX_PATH. Enabling stack-smashing protection (SSP/stack canaries, -fstack-protector-strong) and ASLR at the OS and compile level reduces exploitability of stack overflows even where the overflow itself cannot be prevented. Monitor Ubuntu Security Notices at ubuntu.com/security/notices for the official patch and affected package identification.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today