CVE-2025-40843

CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. CodeChecker versions up to 6.26.1 contain a buffer overflow vulnerability in the internal ldlogger library, which is executed by the CodeChecker log command. This issue affects CodeChecker: through 6.26.1.

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.5 / Impact : 3.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/Ericsson/codechecker/security/advisories/GHSA-5xf2-f6ch-6p8r	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:ericsson:codechecker:*:*:*:*:*:*:*:*

History

08 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) CodeChecker es una herramienta de análisis, base de datos de defectos y extensión de visualizador para Clang Static Analyzer y Clang Tidy. Las versiones de CodeChecker hasta la 6.26.1 contienen una vulnerabilidad de desbordamiento de búfer en la biblioteca interna ldlogger, que es ejecutada por el comando CodeChecker log. Este problema afecta a CodeChecker: hasta la 6.26.1.

Information

Published : 2025-10-28 19:15

Updated : 2026-10-08 11:10

NVD link : CVE-2025-40843

Mitre link : CVE-2025-40843

CVE.ORG link : CVE-2025-40843

JSON object : View

Products Affected

ericsson

codechecker

CWE

CWE-121

Stack-based Buffer Overflow

{"id": "CVE-2025-40843", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-40843", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-28T19:30:15.826239Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.5}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf", "affectedData": [{"vendor": "Ericsson", "product": "CodeChecker", "versions": [{"status": "affected", "version": "0", "versionType": "python", "lessThanOrEqual": "6.26.1"}], "platforms": ["Linux"], "defaultStatus": "unaffected"}]}], "published": "2025-10-28T19:15:41.757", "references": [{"url": "https://github.com/Ericsson/codechecker/security/advisories/GHSA-5xf2-f6ch-6p8r", "tags": ["Exploit", "Vendor Advisory"], "source": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf", "description": [{"lang": "en", "value": "CWE-121"}]}], "descriptions": [{"lang": "en", "value": "CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. \n\n\n\n\nCodeChecker versions up to 6.26.1 contain a buffer overflow vulnerability in the internal ldlogger\u00a0library, which is executed by the CodeChecker log\u00a0command.\n\n\n\n\n\nThis issue affects CodeChecker: through 6.26.1."}, {"lang": "es", "value": "CodeChecker es una herramienta de an\u00e1lisis, base de datos de defectos y extensi\u00f3n de visualizador para Clang Static Analyzer y Clang Tidy.\n\nLas versiones de CodeChecker hasta la 6.26.1 contienen una vulnerabilidad de desbordamiento de b\u00fafer en la biblioteca interna ldlogger, que es ejecutada por el comando CodeChecker log.\n\nEste problema afecta a CodeChecker: hasta la 6.26.1."}], "lastModified": "2026-10-08T11:10:00.250", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ericsson:codechecker:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "86A8B23F-51A5-4124-9FC0-DF0DC43476A0", "versionEndExcluding": "6.26.2"}], "operator": "OR"}]}], "sourceIdentifier": "85b1779b-6ecd-4f52-bcc5-73eac4659dcf"}