Inih
Monthly
A one-byte stack buffer under-read exists in ini_parse_stream() in inih before release r63, reachable when a host application parses attacker-supplied INI content containing a line of at least INI_MAX_LINE-1 bytes immediately followed by an embedded NUL byte. The scored impact is limited to availability: a single out-of-bounds read of abyss[-1] that triggers undefined behavior and can crash the parsing process, with no confidentiality or integrity effect in the assessed vector (the CWE-127 classification reflects the out-of-bounds read class, not a confirmed disclosure primitive). The vector is local (AV:L) and requires the user or application to load the crafted INI data (UI:R/UI:P) with no privileges needed (PR:N); exploitation conditions depend entirely on the host application accepting untrusted INI input. Vendor-released patch: r63, via upstream PR #206 and commit 8e06f6b; a public technical write-up describing the trigger is referenced, but no working exploit code and no active exploitation (CISA KEV) were identified at time of analysis, and the priority label is this_month.
A one-byte stack buffer under-read exists in ini_parse_stream() in inih before release r63, reachable when a host application parses attacker-supplied INI content containing a line of at least INI_MAX_LINE-1 bytes immediately followed by an embedded NUL byte. The scored impact is limited to availability: a single out-of-bounds read of abyss[-1] that triggers undefined behavior and can crash the parsing process, with no confidentiality or integrity effect in the assessed vector (the CWE-127 classification reflects the out-of-bounds read class, not a confirmed disclosure primitive). The vector is local (AV:L) and requires the user or application to load the crafted INI data (UI:R/UI:P) with no privileges needed (PR:N); exploitation conditions depend entirely on the host application accepting untrusted INI input. Vendor-released patch: r63, via upstream PR #206 and commit 8e06f6b; a public technical write-up describing the trigger is referenced, but no working exploit code and no active exploitation (CISA KEV) were identified at time of analysis, and the priority label is this_month.