Stack Buffer Under-Read Vulnerability in inih Before r63 by Ben Hoyt

CVE-2025-71450

What is CVE-2025-71450?

A buffer under-read vulnerability exists in the ini_parse_stream function of the inih library, specifically in versions prior to r63. This issue allows attackers to exploit the parsing of INI files by crafting inputs that consist of a line with at least INI_MAX_LINE-1 bytes followed by an embedded NUL byte. Such crafted files can trigger undefined behavior within the application, as memory sanitizers may report anomalies caused by reading from an invalid memory location, particularly abyss[-1]. The potential for unauthorized data access underscores the necessity for developers to update to patched versions of the library to ensure security.

References