inih Stack Buffer Under-Read in ini_parse_stream

Executive Summary

CVE-2025-71450 is an out-of-bounds read vulnerability in the inih INI file parser library. It occurs in the ini_parse_stream function when handling long lines that exceed the fixed buffer size. If an input contains an embedded NUL byte after an overlong line, the code reads one byte before the start of the abyss buffer, causing a one-byte stack under-read.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect systems using the inih library versions before r63. Check for crashes or memory sanitizer reports when parsing INI files with lines exceeding 199 bytes followed by a NUL byte. Use static analysis tools to identify the vulnerable code pattern in ini_parse_stream().

Useful 0 Not Useful 0

Impact Analysis

This vulnerability may cause undefined behavior or crashes when processing maliciously crafted INI files. It could lead to reading adjacent memory but does not allow information disclosure, out-of-bounds writes, or remote code execution. The impact is limited to potential instability in applications using vulnerable versions of inih.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade to inih version r63 or later, which includes the fix for CVE-2025-71450. If upgrading is not possible, apply the upstream patch from commit 8e06f6b77b5d4471bdc6d85ada81b67d37354a5c to the ini_parse_stream() function in ini.c.

Useful 0 Not Useful 0