EUVD-2026-67716Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:X/RE:L/U:Green
Local build tool invocable by any developer-level user without elevated privileges (PR:N); overflow is deterministic and input-independent (AC:L); only minor stack integrity impact with no confidentiality or availability consequence.
Primary rating from Vendor (ERIC).
CVSS VectorVendor: ERIC
Lifecycle Timeline
1DescriptionCVE.org
CVE-2025-40843 https://github.com/advisories/GHSA-5xf2-f6ch-6p8r was fixed by replacing unchecked strcpy() with a bounded safe_strcpy() helper. At ldlogger-tool-gcc.c:129 the destination passed to that helper is fullPath + 2, but the size passed down is the full PATH_MAX. safe_strcpy() is strncpy(), which NUL-pads the destination out to the whole n, so this site writes 4096 bytes into the 4094 that remain - a 2-byte stack overflow on every invocation, independent of the input path's length.
This issue affects CodeChecker: through 6.28.2.
AnalysisAI
Stack buffer overflow in Ericsson CodeChecker through 6.28.2 results from an off-by-two error introduced during the CVE-2025-40843 remediation: the safe_strcpy() call at ldlogger-tool-gcc.c:129 receives destination pointer fullPath + 2 but the full PATH_MAX (4096) as its size bound, causing a deterministic 2-byte overwrite past the 4094 bytes that actually remain on every invocation of the GCC logger component. The overflow is unconditional and input-independent; a proof-of-concept is noted via the CVSS 4.0 E:P supplemental metric, though no active exploitation (CISA KEV) has been confirmed.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The overflow triggers unconditionally on every invocation of the CodeChecker GCC logger component - no special input path, environment configuration, or non-default feature flag is required to reach the vulnerable site at ldlogger-tool-gcc.c:129. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 2.0 accurately reflects constrained real-world impact: the overflow is exactly 2 bytes, AV:L limits exposure to local actors, and observed impact is low integrity only (VI:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade CodeChecker to a release beyond 6.28.2 that incorporates the corrected safe_strcpy() size argument; consult the vendor advisory at https://github.com/Ericsson/codechecker/security/advisories/GHSA-9gcg-v8fg-39q8 for the specific patched version tag, which is not explicitly named in the available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Codechecker
View allCodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. R
Authentication bypass in CodeChecker allows remote unauthenticated attackers to assign arbitrary permissions to any user
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. R
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. R
Memory exhaustion and disk consumption in Ericsson CodeChecker's massStoreRun API endpoint allows authenticated users ho
Improper access control in Ericsson CodeChecker allows an authenticated user to delete all personal access tokens system
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. R
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today