CVE-2025-40843

HighCVSS 7.8/10Last modified Oct 8, 2026

Description

CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy.

CodeChecker versions up to 6.26.1 contain a buffer overflow vulnerability in the internal ldlogger library, which is executed by the CodeChecker log command.

This issue affects CodeChecker: through 6.26.1.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121

Affected software

No affected versions have been published.

Timeline

Published: Oct 28, 2025
Last modified: Oct 8, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-408467.1Improper Input Validation, the returnUrl parameter in Account Security Settings lacks proper input validation, allowing attackers to redirec CVE-2025-40857.1An attacker with control over a content process could potentially leverage the privileged UITour actor to leak sensitive information or esca CVE-2025-40866.5A specially crafted filename containing a large number of encoded newline characters could obscure the file's extension when displayed in th CVE-2025-40874.8A vulnerability was identified in Thunderbird where XPath parsing could trigger undefined behavior due to missing null checks during attribu CVE-2025-40886.5A security vulnerability in Thunderbird allowed malicious sites to use redirects to send credentialed requests to arbitrary endpoints on any CVE-2025-408856.5A SQL Injection vulnerability was discovered in the Smart Polling functionality due to improper validation of an input parameter. An authent CVE-2025-408868.8A SQL Injection vulnerability was discovered in the Alert functionality due to improper validation of an input parameter. An authenticated u CVE-2025-408876.5A SQL Injection vulnerability was discovered in the Alert functionality due to improper validation of an input parameter. An authenticated u CVE-2025-408886.5A SQL Injection vulnerability was discovered in the CLI functionality due to improper validation of an input parameter. An authenticated use CVE-2025-408898.1A path traversal vulnerability was discovered in the Time Machine functionality due to missing validation of two input parameters. An authen CVE-2025-40895.1Due to insufficient escaping of special characters in the "copy as cURL" feature, an attacker could trick a user into using this command, po CVE-2025-408907.9A Stored Cross-Site Scripting vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter.