The fanx_fingerprint function incorrectly calculates the buffer size for formatting FAN/1 X.509 certificate fingerprints, allocating only strlen(b64)+strlen(hex)+31 bytes while the format string requires 33 fixed characters plus a null terminator, producing a 3‑byte heap overflow. The overflow occurs through an unbounded sprintf that writes the full string to the undersized buffer. If an attacker supplies a crafted pcap file containing a TLS X.509 certificate to a user running ssldump with FAN/1 fingerprinting enabled, the corruption can abort the program or, in the worst case, allow the attacker to execute arbitrary code in the context of the ssldump process. The vulnerability is deterministic, requires no elevated privileges, and is triggered by valid input data. It maps to CWE‑122 (Heap Buffer Overflow) and CWE‑787 (Out‑of‑Bounds Write).

All installations of ssldump from the adulau repository are affected. The vulnerability exists in every release that has not applied the patch located in the commit 8ad55683cc0186600c085d33be5a5b627db78467, where the hard‑coded size calculation and unbounded sprintf were replaced by a safe snprintf approach. No specific version range is listed, so any version before the commit is potentially vulnerable until the fix is applied.

The CVSS score of 6.8 indicates medium‑to‑high severity. EPSS is not available, and the issue is not listed in CISA’s KEV catalog, but the exploitability is high because the overflow occurs on every function call with valid input and requires only that a user execute ssldump with a malicious pcap file. Attackers can gain code execution or cause denial of service without needing elevated privileges, making it a significant local threat for users who run ssldump on untrusted capture files.