Read the docs
TI-2005-03685 Aliases CVE-2005-3891GHSA-jvhq-rf2r-p93j

Stack-based buffer overflow in Gadu-Gadu 7.20 allows remote attackers to cause a denial…

Priority LOW 39Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · Complete
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

Stack-based buffer overflow in Gadu-Gadu 7.20 allows remote attackers to cause a denial of service (crash) via an image filename between exactly 192 to 200 characters, which does not account for the "imgcache\" string that is added to the end of the buffer.

Why it matters now

EPSS 0.0234 83rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:gadu-gadu:gadu-gadu_instant_messenger:7.20:*:*:*:*:*:*:*7.20VulnerableGadu-gadu
  • cpe:2.3:a:gadu-gadu:gadu-gadu_instant_messenger:7.20:*:*:*:*:*:*:* Versions 7.20 Vulnerable ·Gadu-gadu

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2005-3891
  2. 2026-10-03 Alias added: GHSA-jvhq-rf2r-p93j

References

Advisory 1

Other 2

  • TI-2004-01125 Stack-based buffer overflow in the code that sends images in Gadu-Gadu allows remote… CVSS 2.0HIGH 10.0
  • TI-2004-01552 Heap-based buffer overflow in the image sending feature in Gadu-Gadu 6.0 build 149 allows… CVSS 2.0HIGH 7.5
  • TI-2005-03684 Gadu-Gadu 7.20 allows remote attackers to cause a denial of service (crash and… CVSS 2.0HIGH 7.8
  • TI-2005-03682 Memory leak in Gadu-Gadu 7.20 allows remote attackers to cause a denial of service via… CVSS 2.0HIGH 7.8
  • TI-2004-01122 Cross-site scripting vulnerability in the parser for Gadu-Gadu allows remote attackers to… CVSS 2.0HIGH 7.5
  • TI-2005-03681 Gadu-Gadu 7.20 does not properly handle MS-DOS device names in filenames, which allows… CVSS 2.0MEDIUM 5.4
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences