A buffer overflow originates from an off‑by‑two error in CodeChecker’s logging routine. The safe_strcpy helper is invoked with a destination pointer that points two bytes past the start of a 4094‑byte buffer while the size argument is the full PATH_MAX of 4096. Because safe_strcpy uses strncpy and zero‑pads the destination, 4096 bytes are written into a space that can only hold 4094, causing a deterministic 2‑byte stack overflow on every logging operation. The vulnerability is classified as CWE‑787, and no publicly documented remote code execution or privilege escalation has been reported.

The flaw is present in Ericsson’s CodeChecker product versions up to and including 6.28.2.

The CVSS score of 2 reflects a low severity issue. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker would need the ability to trigger CodeChecker logging—either through local code execution or by exploiting another component that runs CodeChecker—to force the overflow. The deterministic nature of the two‑byte overrun means that any such triggering event would corrupt stack data or cause a crash, but no remote attack vector is described.