Low severity · published Aug 28, 2026
CVE-2026-58106
Incomplete fix for CVE-2025-40843: safe_strcpy is called with PATH_MAX into fullPath+2, writing 2 bytes past the buffer on every CodeChecker log invocation
2.0
CVSS
0.2%
EPSS
No
On KEV
Description
CVE-2025-40843 https://github.com/advisories/GHSA-5xf2-f6ch-6p8r was fixed by replacing unchecked strcpy() with a bounded safe_strcpy() helper.
At ldlogger-tool-gcc.c:129 the destination passed to that helper is fullPath + 2, but the size
passed down is the full PATH_MAX. safe_strcpy() is strncpy(), which NUL-pads the
destination out to the whole n, so this site writes 4096 bytes into the 4094 that remain — a
2-byte stack overflow on every invocation, independent of the input path's length.
This issue affects CodeChecker: through 6.28.2.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 6% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
CodeChecker · Ericsson
through 6.28.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-58106
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-58106
github.com
https://github.com/Ericsson/codechecker/security/advisories/GHSA-9gcg-v8fg-39q8
More from CodeChecker
10.0
CVE-2024-10081
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy
9.8
CVE-2026-25660
Authentication bypass for certain API calls
9.0
CVE-2024-10082
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy
8.2
CVE-2024-53829
Cross-Site Request Forgery in CodeChecker API
7.8
CVE-2025-40843
Buffer overflow in CodeChecker log command