Live › vulnerability › CVE-2025-71450
inih is a small C library that parses INI configuration files. Before r63, a crafted line of near-maximum length followed by a NUL byte makes ini_parse_stream() read one byte before a stack buffer, which memory sanitizers flag as undefined behavior.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 15:24 UTC. All times on this page are UTC.
Applications that embed inih before r63 and parse INI data from untrusted sources are exposed. A one-byte read past a stack buffer is mainly a crash or information-leak risk; programs that only read trusted local config files are less exposed.
No product ranges from the sources yet.
r63.ini_parse_stream() or ini_parse_string() that feed untrusted INI input.r63 or later (per the linked patch and release notes).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
inih before r63 contains a one-byte stack buffer under-read in ini_parse_stream() in ini.c that allows attackers to read abyss[-1] via an embedded NUL byte after an overlong line. Attackers can supply an INI file or string with a line of at least INI_MAX_LINE-1 bytes followed by a NUL byte, causing undefined behavior reported by memory sanitizers.
This page as .md · .json · in your agent: get_signal("CVE-2025-71450")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.