The vulnerability is a one‑byte stack buffer under‑read in the ini_parse_stream function of inih. An attacker who can supply an INI file or string with an overlong line ending with a NUL byte can cause the parser to read memory beyond the allocated buffer, potentially exposing stack contents. The bug is classified as buffer under-read (CWE‑127) and carries a CVSS score of 4.8, indicating moderate severity, and primarily allows information disclosure.

This flaw affects the inih library released by benhoyt. All versions prior to release r63 are vulnerable. The vulnerability was discovered in the git commit referenced in the advisories and has been patched in the r63 release.

The attack requires the ability to supply a crafted INI string or file to a vulnerable instance of ini_parse_stream. Therefore the primary vector is local file or config injection, though applications that accept untrusted configuration data could be exposed remotely. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting that it is not widely exploited yet. Nonetheless the modest CVSS score and potential for leaking sensitive values warrant timely mitigation.