CVE-2016-2233

Stack-based buffer overflow in the inbound_cap_ls function in common/inbound.c in HexChat 2.10.2...

7.5 HighPublic exploitFix available

CVE-2016-2233 is a high vulnerability (CVSS 7.5) in Hexchat Project Hexchat, published January 18, 2017. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 34.1%, the 98th percentile. Fixed in hexchat 2.12.0-1.

Stack-based buffer overflow in the inbound_cap_ls function in common/inbound.c in HexChat 2.10.2 allows remote IRC servers to cause a denial of service (crash) via a large number of options in a CAP LS message.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

34.1%Up 19.0 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

Record: CVE-2016-2233
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness: CWE-119
Updated: 2026-11-02

CVE List No score

Record: CVE-2016-2233
Updated: 2026-11-02

EUVDEUVD-2016-3317 No score

Record: EUVD-2016-3317
Updated: 2026-11-03

GitHub AdvisoriesGHSA-xgr5-8gm5-gj39 7.5

Stack-based buffer overflow in the inbound_cap_ls function in common/inbound.c in HexChat 2.10.2...

Record: GHSA-xgr5-8gm5-gj39
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-119
Updated: 2026-11-02

OSV 7.5

Record: CVE-2016-2233
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2016-2233 7.5

Record: DEBIAN-CVE-2016-2233
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2016-2233 7.5

Record: UBUNTU-CVE-2016-2233
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Affected products

hexchat project hexchat

Affected packages

Affected packages
Package	Affected	Fixed
`hexchat` Debian:12	before 2.12.0-1	2.12.0-1
`hexchat` Debian:13	before 2.12.0-1	2.12.0-1
`xchat-gnome` Ubuntu:16.04:LTS	All versions, plus listed versions 1:0.30.0~git20141005.816798-0ubuntu61:0.30.0~git20141005.816798-0ubuntu71:0.30.0~git20141005.816798-0ubuntu81:0.30.0~git20141005.816798-0ubuntu9	None known
`hexchat` Ubuntu:16.04:LTS	All versions, plus listed versions 2.10.2-1ubuntu22.10.2-1ubuntu3	None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Hexchat IRC Client 2.11.0 - CAP LS Handling Buffer Overflow	2016-04-04
PoC in GitHub	fath0218/CVE-2016-2233	2018-12-03

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV, PoC in GitHub