inih before r63 Stack Buffer Under-Read in ini_parse_stream Discard Loop
Affects inih r62 and earlier, in default builds with INI_USE_STACK 1 and INI_MAX_LINE 200 when input has a long first line with no newline followed by a NUL byte. Fixed in r63.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in r63
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. Input contains a first line of at least INI_MAX_LINE - 1 bytes with no newline, immediately followed by a NUL byte. Default configuration build of inih (INI_USE_STACK 1, INI_MAX_LINE 200). Affects inih r62 and earlier, before the fix was released.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 10/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in r63
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
inih (INI Not Invented Here), a small C library for parsing INI configuration files, is affected by this flaw. An attacker who supplies a specially crafted INI file or string can trigger a one-byte read before the bounds of a stack buffer, which can cause undefined behavior and memory errors that sanitizers detect.
Read the original description
inih before r63 contains a one-byte stack buffer under-read in ini_parse_stream() in ini.c that allows attackers to read abyss[-1] via an embedded NUL byte after an overlong line. Attackers can supply an INI file or string with a line of at least INI_MAX_LINE-1 bytes followed by a NUL byte, causing undefined behavior reported by memory sanitizers.
What to do
Check whether your setup matches what the bug needs.
Input contains a first line of at least INI_MAX_LINE - 1 bytes with no newline, immediately followed by a NUL byte. Default configuration build of inih (INI_USE_STACK 1, INI_MAX_LINE 200). Affects inih r62 and earlier, before the fix was released.Upgrade to a fixed version: r63.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- benhoyt inih
fixed in r63
Evidence 7
- Patch
- Patch
- Report
- Repository
- Repository
Show all 7 sourcesShow fewer sources
- Link
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2025-71450
What does this mean?
The parser's discard loop can read one byte past the end of a stack buffer named abyss while skipping an overlong first line. The advisory says no data is returned to the caller and no write occurs.Source: github.com
Am I affected, and how do I check?
Versions r62 and earlier are affected, with the default configuration (INI_USE_STACK 1, INI_MAX_LINE 200) and input whose first line is at least 199 bytes with no newline, immediately followed by a NUL byte. To check, look at the INI_USE_STACK and INI_MAX_LINE values in ini.h and the inih release tag in use.Source: github.com
What should I do about it?
Upgrade to inih r63, which contains the fix.Source: github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data