What’s Vulnerable › Vulnerabilities

CVE-2026-58106: Incomplete fix for CVE-2025-40843: safe_strcpy is called with PATH_MAX into fullPath+2, writing 2 bytes past the buffer on every CodeChecker log invocation

• Severity: low (CVSS 2.0 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-28 · updated 2026-09-01
• Weakness: CWE-787

Description

CVE-2025-40843 https://github.com/advisories/GHSA-5xf2-f6ch-6p8r  was fixed by replacing unchecked strcpy() with a bounded safe_strcpy() helper. At ldlogger-tool-gcc.c:129 the destination passed to that helper is fullPath + 2, but the size passed down is the full PATH_MAX. safe_strcpy() is strncpy(), which NUL-pads the destination out to the whole n, so this site writes 4096 bytes into the 4094 that remain — a 2-byte stack overflow on every invocation, independent of the input path's length. This issue affects CodeChecker: through 6.28.2.

Affected products

• Ericsson CodeChecker: through 6.28.2

References

• https://github.com/Ericsson/codechecker/security/advisories/GHSA-9gcg-v8fg-39q8
• https://github.com/Ericsson/codechecker/security/advisories/GHSA-9gcg-v8fg-39q8

Get alerted when CVE-2026-58106 or the next vulnerability affects your stack