Read the docs
TI-2025-44001 Aliases CVE-2025-71450GHSA-gh7m-xpp3-w3vq

Stack buffer under-read in inih ini_parse_stream

Priority MEDIUM 55CWE-127Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

The inih INI parser before r63 contains a one-byte stack buffer under-read in ini_parse_stream(). A local attacker with no privileges can trigger it when a user processes an INI file or string with a line of at least INI_MAX_LINE-1 bytes followed by a NUL byte, which causes undefined behavior that memory sanitizers report (CWE-127).

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

inih before r63 contains a one-byte stack buffer under-read in ini_parse_stream() in ini.c that allows attackers to read abyss[-1] via an embedded NUL byte after an overlong line. Attackers can supply an INI file or string with a line of at least INI_MAX_LINE-1 bytes followed by a NUL byte, causing undefined behavior reported by memory sanitizers.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00127 2nd percentileScored 2026-11-07
Fix Fixed inih (benhoyt): r63

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
benhoytinihbefore r63r63Patch availableCNA
  • inih Vendorbenhoyt Affected before r63 Fixed in r63 Patch available CNA

Remediation

Update inih to r63, the fixed version. The sources list no advisory identifier for this fix.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA inih (benhoyt) Fixed in r63

Timeline

  1. 2026-11-02 Threatist record created from CVE-2025-71450
  2. 2026-11-02 Alias added: GHSA-gh7m-xpp3-w3vq
  3. 2026-11-06 CISA SSVC decision points changed
  4. 2026-11-06 Priority changed: LOW → MEDIUM

References

Patch 2

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences