CodeChecker CVE-2026-58106

The overflow triggers unconditionally on every invocation of the CodeChecker GCC logger component - no special input path, environment configuration, or non-default feature flag is required to reach the vulnerable site at ldlogger-tool-gcc.c:129. The sole prerequisite is local access to a host running CodeChecker (AV:L); no elevated privileges are needed to invoke the tool (PR:N per vendor CVSS vector). Exploitation is physically constrained to exactly 2 bytes of stack overwrite: in binaries compiled with stack canary protection, the process will abort before any useful payload executes, limiting realistic impact to a process crash. Environments that compile CodeChecker without stack protection (e.g., some embedded or legacy CI configurations) face modestly higher risk of adjacent stack data corruption.

The CVSS 4.0 score of 2.0 accurately reflects constrained real-world impact: the overflow is exactly 2 bytes, AV:L limits exposure to local actors, and observed impact is low integrity only (VI:L). The most significant risk signal is the deterministic, input-independent nature of the overflow - it fires on every invocation, making it trivially reproducible and reliably detectable by any local user. The E:P supplemental metric indicates a proof-of-concept exists, which elevates this above a purely theoretical flaw. However, modern stack protections (canaries, ASLR, NX stacks) substantially reduce the probability of achieving arbitrary code execution from a 2-byte overwrite, and the absence of a CISA KEV listing confirms no observed active exploitation. No EPSS data was provided in the input; risk cannot be quantified probabilistically from available data. The CVSS PR:N at AV:L is internally consistent: CodeChecker is a developer-level tool invoking without elevated privileges.

A local user on a developer workstation or CI/CD build node invokes any CodeChecker operation that triggers the GCC logger component, unconditionally overwriting 2 bytes past a stack buffer at ldlogger-tool-gcc.c:129. With a proof-of-concept noted in the CVSS supplemental data, an attacker with local access could attempt to exploit the overflow to corrupt adjacent stack metadata or a stack canary, though reliable code execution from a fixed 2-byte overwrite requires bypassing modern mitigations and is unlikely in standard hardened build environments.