---
id: CVE-2025-71450
title: inih before r63 Stack Buffer Under-Read in ini_parse_stream Discard Loop
summary: >-
  inih before r63 contains a one-byte stack buffer under-read in
  ini_parse_stream() in ini.c that allows attackers to read abyss[-1] via an
  embedded NUL byte after an overlong line. Attackers can supply an INI file or
  string with a line of…
severity: low
cvss: 3.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L'
cvssSource: cna
cwe:
  - CWE-127
vendor: benhoyt
product: inih
affected:
  - inih < r63
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T19:22:12.946222Z'
exploitAvailable: true
published: '2026-11-02'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T19:22:48.149Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-71450'
references:
  - url: 'https://github.com/benhoyt/inih/pull/206'
  - url: 'https://github.com/benhoyt/inih/issues/223'
  - url: >-
      https://github.com/benhoyt/inih/commit/8e06f6b77b5d4471bdc6d85ada81b67d37354a5c
  - url: 'https://github.com/benhoyt/inih/blob/r62/ini.c#L162-L169'
  - url: 'https://github.com/benhoyt/inih/releases/tag/r63'
    label: inih r63 Release Notes
  - url: 'https://hackmd.io/@haindpwn/inih-long-line-discard-oob-read'
  - url: >-
      https://www.vulncheck.com/advisories/inih-before-r63-stack-buffer-under-read-in-ini-parse-stream-discard-loop
    label: >-
      VulnCheck Advisory: inih before r63 Stack Buffer Under-Read in
      ini_parse_stream Discard Loop
tags:
  - cve.org
  - exploit-available
epss: 0.00127
epssPercentile: 0.0237
ingestedAt: '2026-11-05T19:30:42.651Z'
---

## Overview

inih before r63 contains a one-byte stack buffer under-read in ini_parse_stream() in ini.c that allows attackers to read abyss[-1] via an embedded NUL byte after an overlong line. Attackers can supply an INI file or string with a line of at least INI_MAX_LINE-1 bytes followed by a NUL byte, causing undefined behavior reported by memory sanitizers.

## Affected

- `inih < r63`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.