{"id":"CVE-2025-40843","aliases":["EUVD-2025-30823","GHSA-5xf2-f6ch-6p8r","PYSEC-2025-100"],"status":"published","title":"Buffer overflow in CodeChecker log command","description":"CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. \n\n\n\n\nCodeChecker versions up to 6.26.1 contain a buffer overflow vulnerability in the internal ldlogger library, which is executed by the CodeChecker log command.\n\n\n\n\n\nThis issue affects CodeChecker: through 6.26.1.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00192,"percentile":0.08972,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-121"],"published":"2025-09-22T18:04:20Z","modified":"2026-10-28T02:30:34Z","fixes":[{"ecosystem":"PyPI","package":"codechecker","fixed_in":["6.26.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"codechecker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.26.1"},{"fixed":"6.26.2"}]}]},{"source":"osv","ecosystem":"PyPI","package":"codechecker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.26.2"}]}],"versions":["6.16.0","6.16.0a1","6.17.0","6.18.0","6.18.1","6.18.2","6.19.0","6.19.1","6.20.0","6.20.0rc1","6.21.0","6.21.0rc1","6.22.0","6.22.0rc1","6.22.1","6.22.2","6.22.2.post1","6.23.0","6.23.0rc2","6.23.1","6.24.0","6.24.1","6.24.2","6.24.4","6.25.0","6.25.1","6.26.0","6.26.1"]},{"source":"osv","ecosystem":"PyPI","package":"codechecker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.26.2"}]}],"versions":["6.16.0","6.16.0a1","6.17.0","6.18.0","6.18.1","6.18.2","6.19.0","6.19.1","6.20.0","6.20.0rc1","6.21.0","6.21.0rc1","6.22.0","6.22.0rc1","6.22.1","6.22.2","6.22.2.post1","6.23.0","6.23.0rc2","6.23.1","6.24.0","6.24.1","6.24.2","6.24.4","6.25.0","6.25.1","6.26.0","6.26.1"]}],"products":[{"vendor":"ericsson","product":"codechecker"}],"references":[{"url":"https://github.com/Ericsson/codechecker/security/advisories/GHSA-5xf2-f6ch-6p8r","tags":["vendor-advisory","Exploit","Vendor Advisory","advisory","web","evidence"]},{"url":"https://github.com/Ericsson/codechecker/commit/4122eb1b43d00c880e4f0747d2ca0a674feb7a50","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40843","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/codechecker/PYSEC-2025-100.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-5xf2-f6ch-6p8r"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40843.json","tags":["advisory"]},{"url":"https://github.com/Ericsson/codechecker","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-40843","title":"Buffer overflow in CodeChecker log command","description":"CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. \n\n\n\n\nCodeChecker versions up to 6.26.1 contain a buffer overflow vulnerability in the internal ldlogger library, which is executed by the CodeChecker log command.\n\n\n\n\n\nThis issue affects CodeChecker: through 6.26.1.","status":"published","published":"2025-10-28T18:49:49.516Z","modified":"2025-10-28T19:30:25.737Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T14:32:34.773122Z"}],"euvd":[{"id":"EUVD-2025-30823","description":"CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. \n\n\n\n\nCodeChecker versions up to 6.26.1 contain a buffer overflow vulnerability in the internal ldlogger library, which is executed by the CodeChecker log command.\n\n\n\n\n\nThis issue affects CodeChecker: through 6.26.1.","status":"published","published":"2025-10-28T18:49:49Z","modified":"2025-10-28T19:30:25Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T19:49:36.644055Z"}],"ghsa":[{"id":"GHSA-5xf2-f6ch-6p8r","title":"CodeChecker has a buffer overflow in the log command","description":"### Summary\nCodeChecker versions up to 6.26.1 contain a buffer overflow vulnerability in the internal `ldlogger` library, which is executed by the `CodeChecker log` command.\n\n### Details\nUnsafe usage of `strcpy()` function in the internal `ldlogger` library allows attackers to trigger a buffer overflow by supplying crafted inputs from the command line. Specifically, the destination buffer is stack-allocated with a fixed size of 4096 bytes, while `strcpy()` is called without any length checks, enabling an attacker to overrun the buffer.\n\n### PoC\nExample script is included below to illustrate how this vulnerability can be exploited.\n```bash\n#!/bin/bash\n\nexport CC_LOGGER_DEF_DIRS=1; \npayload=''; for i in $(seq 1 4090); do payload+='A'; done\n\nCodeChecker log -b \"/very/long/path/to/$payload/gcc a.c\" -o compilation.json\n```\n\n### Impact\nAny environment where the vulnerable `CodeChecker log` command is executed with untrusted user input is affected by this vulnerability.","status":"published","published":"2025-09-22T18:04:20Z","modified":"2026-06-05T14:33:30Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T14:40:17.745826Z"}],"nvd":[{"id":"CVE-2025-40843","description":"CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. \n\n\n\n\nCodeChecker versions up to 6.26.1 contain a buffer overflow vulnerability in the internal ldlogger library, which is executed by the CodeChecker log command.\n\n\n\n\n\nThis issue affects CodeChecker: through 6.26.1.","status":"published","published":"2025-10-28T19:15:41.757Z","modified":"2026-10-08T11:10:00.25Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T14:11:40.754193Z"}],"osv":[{"id":"CVE-2025-40843","title":"Buffer overflow in CodeChecker log command","description":"CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. \n\n\n\n\nCodeChecker versions up to 6.26.1 contain a buffer overflow vulnerability in the internal ldlogger library, which is executed by the CodeChecker log command.\n\n\n\n\n\nThis issue affects CodeChecker: through 6.26.1.","status":"published","published":"2025-10-28T18:49:49.516Z","modified":"2026-10-28T02:30:34.929090618Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T15:44:49.394967Z"},{"id":"GHSA-5xf2-f6ch-6p8r","title":"CodeChecker has a buffer overflow in the log command","description":"### Summary\nCodeChecker versions up to 6.26.1 contain a buffer overflow vulnerability in the internal `ldlogger` library, which is executed by the `CodeChecker log` command.\n\n### Details\nUnsafe usage of `strcpy()` function in the internal `ldlogger` library allows attackers to trigger a buffer overflow by supplying crafted inputs from the command line. Specifically, the destination buffer is stack-allocated with a fixed size of 4096 bytes, while `strcpy()` is called without any length checks, enabling an attacker to overrun the buffer.\n\n### PoC\nExample script is included below to illustrate how this vulnerability can be exploited.\n```bash\n#!/bin/bash\n\nexport CC_LOGGER_DEF_DIRS=1; \npayload=''; for i in $(seq 1 4090); do payload+='A'; done\n\nCodeChecker log -b \"/very/long/path/to/$payload/gcc a.c\" -o compilation.json\n```\n\n### Impact\nAny environment where the vulnerable `CodeChecker log` command is executed with untrusted user input is affected by this vulnerability.","status":"published","published":"2025-09-22T18:04:20Z","modified":"2026-06-05T14:45:49.832338459Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T15:46:38.911014Z"},{"id":"PYSEC-2025-100","description":"CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. \n\n\n\n\nCodeChecker versions up to 6.26.1 contain a buffer overflow vulnerability in the internal ldlogger library, which is executed by the CodeChecker log command.\n\n\n\n\n\nThis issue affects CodeChecker: through 6.26.1.","status":"published","published":"2025-10-28T19:15:41.757Z","modified":"2026-05-20T09:18:55.290654Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:54.242332Z"}]}}