Vulnerability Description
CVE-2025-40843 https://github.com/advisories/GHSA-5xf2-f6ch-6p8r was fixed by replacing unchecked strcpy() with a bounded safe_strcpy() helper. At ldlogger-tool-gcc.c:129 the destination passed to that helper is fullPath + 2, but the size passed down is the full PATH_MAX. safe_strcpy() is strncpy(), which NUL-pads the destination out to the whole n, so this site writes 4096 bytes into the 4094 that remain — a 2-byte stack overflow on every invocation, independent of the input path's length. This issue affects CodeChecker: through 6.28.2.
Related Weaknesses (CWE)
References
- https://github.com/Ericsson/codechecker/security/advisories/GHSA-9gcg-v8fg-39q8
- https://github.com/Ericsson/codechecker/security/advisories/GHSA-9gcg-v8fg-39q8
FAQ
What is CVE-2026-58106?
CVE-2026-58106 is a documented vulnerability. CVE-2025-40843 https://github.com/advisories/GHSA-5xf2-f6ch-6p8r was fixed by replacing unchecked strcpy() with a bounded safe_strcpy() helper. At ldlogger-tool-gcc.c:129 the destination passed to th...
How severe is CVE-2026-58106?
CVSS scoring is not yet available for CVE-2026-58106. Check NVD for updates.
Is there a patch for CVE-2026-58106?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.