PT-2026-7630 · Unknown · Opensatkit

Published 2026-02-11 · Updated 2026-02-12 · CVE-2025-70085

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenSatKit version 2.2.1

Description The software contains a buffer overflow issue due to the use of sprintf without proper length checking when formatting filenames into the EventErrStr buffer. The EventErrStr buffer is fixed at 256 bytes. The sprintf function is used in functions like FILE ConcatenateCmd() and ConcatenateFiles() within the file.c file. If the combined length of the formatted filenames and constant text exceeds 256 bytes, a stack buffer overflow occurs. The filenames can approach OS MAX PATH LEN (typically 64-256 bytes) in length, contributing to the overflow.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting the maximum length of filenames processed by the affected functions.

Fix

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

CVE-2025-70085

Affected Products

Opensatkit

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-70085 · Security Note
• https://osv.dev/vulnerability/CVE-2025-70085 · Vendor Advisory
• https://github.com/OpenSatKit/OpenSatKit/releases/tag/v2.2.1 · Note
• https://github.com/OpenSatKit/OpenSatKit · Note
• https://gist.github.com/jonafk555 · Note
• https://raw.githubusercontent.com/OpenSatKit/OpenSatKit/master/cfs/apps/filemgr/fsw/src/file.c · Note
• https://twitter.com/VulmonFeeds/status/2021756948094321056 · Twitter Post
• https://t.me/CVEtracker/44451 · Telegram Post