5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-40843

CVE-2025-40843: CodeChecker has a buffer overflow in the log command

Summary

CodeChecker versions up to 6.26.1 contain a buffer overflow vulnerability in the internal ldlogger library, which is executed by the CodeChecker log command.

Details

Unsafe usage of strcpy() function in the internal ldlogger library allows attackers to trigger a buffer overflow by supplying crafted inputs from the command line. Specifically, the destination buffer is stack-allocated with a fixed size of 4096 bytes, while strcpy() is called without any length checks, enabling an attacker to overrun the buffer.

PoC

Example script is included below to illustrate how this vulnerability can be exploited.

#!/bin/bash

export CC_LOGGER_DEF_DIRS=1; 
payload=''; for i in $(seq 1 4090); do payload+='A'; done

CodeChecker log -b "/very/long/path/to/$payload/gcc a.c" -o compilation.json

Impact

Any environment where the vulnerable CodeChecker log command is executed with untrusted user input is affected by this vulnerability.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-40843

CVE-2025-40843:

5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
codechecker	pip	<= 6.26.1	6.26.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic stack-based buffer overflow (CWE-121) within the ldlogger library of CodeChecker, which is written in C. The root cause is the widespread and unsafe use of strcpy() and strcat() functions across multiple files in the library. These functions do not perform bounds checking, allowing an attacker to write past the boundaries of stack-allocated buffers.

The provided patch systematically replaces all occurrences of strcpy() and strcat() with newly implemented safe alternatives, safe_strcpy() and safe_strcat(). These new functions validate the input length against the destination buffer size and terminate the program if a truncation would occur, thus mitigating the overflow vulnerability.

The primary attack vector is the CodeChecker log command, which takes user-supplied command-line arguments (such as the build command) and passes them to the ldlogger library for processing. The Proof of Concept demonstrates this by passing an overly long path to the compiler.

The function getDefaultArguments in ldlogger-tool-gcc.c is identified with high confidence as it directly handles the compiler command string, making it a primary target for the exploit described. Other functions listed are also vulnerable due to the same unsafe string operations, but they might be triggered by different inputs or code paths. Any of these functions could appear in a runtime profile or stack trace during exploitation.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.