PT-2025-39096 · Unknown · Codechecker

Published 2025-09-22 · Updated 2025-11-14 · CVE-2025-40843

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CodeChecker versions through 6.26.1

Description CodeChecker versions up to 6.26.1 contain a buffer overflow in the internal ldlogger library, triggered when executing the CodeChecker log command. The issue stems from the unsafe use of the strcpy() function without length checks, allowing an attacker to overrun a stack-allocated buffer of 4096 bytes by providing crafted inputs via the command line. An example script demonstrates exploitation by supplying a payload exceeding the buffer's capacity to the CodeChecker log command with the -b option. Environments executing the vulnerable CodeChecker log command with untrusted user input are affected. The API endpoint involved is /very/long/path/to/$payload/gcc a.c, where payload is a crafted input.

Recommendations Versions prior to 6.26.1 should be updated.

Fix

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

CVE-2025-40843

GHSA-5XF2-F6CH-6P8R

PYSEC-2025-100

Affected Products

Codechecker

References · 10

• https://github.com/Ericsson/codechecker/security/advisories/GHSA-5xf2-f6ch-6p8r · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-40843 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5xf2-f6ch-6p8r · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2025-100 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-40843 · Security Note
• https://github.com/Ericsson/codechecker · Note
• https://github.com/Ericsson/codechecker/commit/4122eb1b43d00c880e4f0747d2ca0a674feb7a50 · Note
• https://twitter.com/CVEnew/status/1983250764739879232 · Twitter Post
• https://t.me/cveNotify/142857 · Telegram Post
• https://t.me/CVEtracker/35992 · Telegram Post