KiTTY vulnerable to stack-based buffer overflow via username

CVE-2024-25004

What is CVE-2024-25004?

KiTTY versions up to and including 0.76.1.13 exhibit a vulnerability where a stack-based buffer overflow can be triggered via unsafe input in the username field. This occurs due to a lack of adequate bounds checking and input sanitization at line 2600 of the code. When exploited, this vulnerability enables an attacker to overwrite adjacent memory, potentially allowing for arbitrary code execution. Users should upgrade to patched versions to mitigate the risk associated with this vulnerability.

References