UBUNTU-CVE-2025-71450: Medium severity ubuntu/libinih vulnerability
inih before r63 contains a one-byte stack buffer under-read in iniparsestream() in ini.c that allows attackers to read abyss[-1] via an embedded NUL byte after an overlong line. Attackers can supply an INI file or string with a line of at least INIMAXLINE-1 bytes followed by a NUL byte, causing undefined behavior reported by memory sanitizers.
Affected Software
Event History
Frequently Asked Questions
What must an attacker be able to do to trigger the issue?
They must cause an application using the affected library to parse a crafted INI file or string. The input needs an overlong line of at least INI_MAX_LINE-1 bytes followed by an embedded NUL byte; the CVSS vector indicates local access, no privileges, and user interaction are involved.
Which upstream releases are affected?
The issue affects inih releases before r63. The provided data does not identify the Ubuntu package versions containing a fix.