CVE-2025-40843

Buffer overflow in CodeChecker log command

CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. CodeChecker versions up to 6.26.1 contain a buffer overflow vulnerability in the internal ldlogger library, which is executed by the CodeChecker log command. This issue affects CodeChecker: through 6.26.1.

Affected

Ericsson · CodeChecker

CVSS v3.1 NVD

7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 CNA

5.9 MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS

0.19% chance of exploitation in the next 30 days, 8th percentile

Published

2025-10-28

Proof-of-concept exploits (1)

• advisories/GHSA-5xf2-f6ch-6p8r

Security advisories

• Ericsson/codechecker/security/advisories/GHSA-5xf2-f6ch-6p8r

References

• CVE Record
• NVD entry