CVE-2015-8972

Stack-based buffer overflow in the ValidateMove function in frontend/move.cc in GNU Chess (aka...

9.8 CriticalFix available

CVE-2015-8972 is a critical vulnerability (CVSS 9.8) in Gnu Chess, published November 17, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.76%, the 89th percentile. Fixed in gnuchess 6.2.4-1.

Stack-based buffer overflow in the ValidateMove function in frontend/move.cc in GNU Chess (aka gnuchess) before 6.2.4 might allow context-dependent attackers to execute arbitrary code via a large input, as demonstrated when in UCI mode.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

3.76%Up 1.2 points since Feb 4, 2022

What each source reports

NVD Score used 9.8

Record: CVE-2015-8972
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-119
Updated: 2026-11-02

CVE List No score

Record: CVE-2015-8972
Updated: 2026-11-02

EUVDEUVD-2015-8826 No score

Record: EUVD-2015-8826
Updated: 2026-11-03

GitHub AdvisoriesGHSA-m3c3-j429-9q78 9.8

Stack-based buffer overflow in the ValidateMove function in frontend/move.cc in GNU Chess (aka...

Record: GHSA-m3c3-j429-9q78
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-119
Updated: 2026-11-02

OSV 9.8

Record: CVE-2015-8972
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2015-8972 9.8

Record: DEBIAN-CVE-2015-8972
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2015-8972 9.8

Record: UBUNTU-CVE-2015-8972
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVMGASA-2016-0390 No score

Updated gnuchess packages fix security vulnerability

gnuchess before 6.2.4 is vulnerable to a stack buffer overflow related to user move input, where 160 characters of input can crash gnuchess (CVE-2015-8972).

Record: MGASA-2016-0390
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10338-1 No score

gnuchess-6.2.4-1.1 on GA media

These are all security issues fixed in the gnuchess-6.2.4-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10338-1
Updated: 2026-11-02

Affected products

gnu chess

Affected packages

Affected packages
Package	Affected	Fixed
`gnuchess` Debian:12	before 6.2.4-1	6.2.4-1
`gnuchess` Debian:13	before 6.2.4-1	6.2.4-1
`gnuchess` Debian:14	before 6.2.4-1	6.2.4-1
`gnuchess` Mageia:5	before 6.1.1-3.1.mga5	6.1.1-3.1.mga5
`gnuchess` Ubuntu:16.04:LTS	All versions, plus listed versions 6.2.1-16.2.2-1	None known
`gnuchess` openSUSE:Tumbleweed	before 6.2.4-1.1	6.2.4-1.1

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 8 moreShow less