Severity by source
Assumed network-reachable via crafted input with no authentication; UI:R because text rendering typically requires user-triggered display action; high CIA impact for combined OOB read/write.
Lifecycle Timeline
1DescriptionCVE.org
[GHSA-pjjp-65r7-ppgm: Out-of-bounds read and write in wrap_lines_measure]
AnalysisAI
Out-of-bounds read and write conditions exist in the wrap_lines_measure function, as tracked under GHSA-pjjp-65r7-ppgm and reported by Ubuntu. Memory corruption of this class - simultaneous OOB read and write - typically enables attackers to leak sensitive memory contents and corrupt heap or stack state, potentially leading to arbitrary code execution or process crash depending on exploitability conditions. No CVSS vector, EPSS score, KEV status, or POC availability data was supplied, so severity and real-world risk cannot be quantified with confidence at this time.
Technical ContextAI
The vulnerability resides in a function named wrap_lines_measure, which by naming convention performs measurement or layout calculation for line-wrapping operations - a pattern common in terminal UI libraries, text rendering engines, and TUI (text user interface) frameworks. Out-of-bounds read (CWE-125 class) and out-of-bounds write (CWE-787 class) occurring together in a measurement function strongly suggest an integer arithmetic or buffer-sizing error where the computed buffer length does not account for edge cases in input (e.g., extremely long lines, zero-length input, or Unicode multibyte sequences). No CPE strings, CWE identifiers, or affected version ranges were provided in the input data, so the exact library or package cannot be confirmed from available intelligence. Ubuntu is listed as the reporting vendor, suggesting the affected component is present in the Ubuntu package ecosystem.
Affected ProductsAI
The affected product is identified only by the function name wrap_lines_measure as reported via Ubuntu and GHSA-pjjp-65r7-ppgm. No CPE strings, package names, version ranges, or vendor advisory URLs were included in the provided intelligence. Ubuntu users should monitor Ubuntu Security Notices (USN) and the GHSA advisory at https://github.com/advisories/GHSA-pjjp-65r7-ppgm for confirmed package names and affected version ranges as they become available.
RemediationAI
No patch version, fix commit, or vendor advisory URL was provided in the available data. Administrators should monitor the GHSA advisory GHSA-pjjp-65r7-ppgm and Ubuntu Security Notices for patch availability. As an interim compensating control, if the affected library processes untrusted user-supplied text input, consider restricting the maximum input length or sanitizing inputs at the application boundary to reduce exposure to malformed content that may trigger the out-of-bounds condition. The trade-off of input length restriction is potential breakage of legitimate long-line content. No specific upstream fix version can be cited from the data provided.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today