CVE-2025-71450

Low

Description

inih before r63 contains a one-byte stack buffer under-read in ini_parse_stream() in ini.c that allows attackers to read abyss[-1] via an embedded NUL byte after an overlong line. Attackers can supply an INI file or string with a line of at least INI_MAX_LINE-1 bytes followed by a NUL byte, causing undefined behavior reported by memory sanitizers.

SeverityLow

CVSS3.3

Exploit probability—

ProductBenhoyt Inih

PublishedNov 2, 2026

First seenNov 4, 2026

Weakness typeCWE-127CWE-127

How to fix

Update

benhoyt inihr63 or later

Patches

github.com/benhoyt/inih/pull/206
github.com/benhoyt/inih/commit/8e06f6b77b5d4471bdc6d85ada81b67d37354a5c

Vendor advisories

github.com/benhoyt/inih/releases/tag/r63

Affected products

Product	Affected versions	Fixed in
benhoyt inih	v < r63	r63

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.