https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T10:56:19.647474+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2025-40843 CVE-2025-40843 — Buffer overflow in CodeChecker log command 2026-10-04T10:56:19.648983+00:00

Affected: Ericsson CodeChecker

CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy.

CodeChecker versions up to 6.26.1 contain a buffer overflow vulnerability in the internal ldlogger library, which is executed by the CodeChecker log command.

This issue affects CodeChecker: through 6.26.1.

 https://cve.radiocsirt.org/vuln/ghsa-5xf2-f6ch-6p8r GHSA-5xf2-f6ch-6p8r — CodeChecker has a buffer overflow in the log command 2026-10-04T10:56:19.649032+00:00

Affected: PyPI: codechecker

### Summary CodeChecker versions up to 6.26.1 contain a buffer overflow vulnerability in the internal `ldlogger` library, which is executed by the `CodeChecker log` command.

### Details Unsafe usage of `strcpy()` function in the internal `ldlogger` library allows attackers to trigger a buffer overflow by supplying crafted inputs from the command line. Specifically, the destination buffer is stack-allocated with a fixed size of 4096 bytes, while `strcpy()` is called without any length checks, enabling an attacker to overrun the buffer.

### PoC Example script is included below to illustrate how this vulnerability can be exploited. ```bash #!/bin/bash

export CC_LOGGER_DEF_DIRS=1; payload=''; for i in $(seq 1 4090); do payload+='A'; done

CodeChecker log -b "/very/long/path/to/$payload/gcc a.c" -o compilation.json ```

### Impact Any environment where the vulnerable `CodeChecker log` command is executed with untrusted user input is affected by this vulnerability.