CVE-2026-58106 Overview
CVE-2026-58106 is a stack-based out-of-bounds write [CWE-787] in CodeChecker's ldlogger-tool-gcc.c. The flaw was introduced by an incomplete fix for CVE-2025-40843, which replaced an unchecked strcpy() with a bounded safe_strcpy() helper. The helper wraps strncpy(), which NUL-pads the destination out to the supplied size. At line 129, the destination is fullPath + 2 while the size argument remains PATH_MAX (4096), producing a 2-byte stack overflow on every invocation regardless of the input path length. The issue affects CodeChecker versions through 6.28.2.
Critical Impact
A local user invoking the logger tool triggers a deterministic 2-byte write past the end of a stack buffer, corrupting adjacent stack memory during every call.
Affected Products
- Ericsson CodeChecker through 6.28.2
- ldlogger-tool-gcc build-logger component
- Downstream analysis pipelines that invoke CodeChecker's build logger
Discovery Timeline
- 2026-08-28 - CVE-2026-58106 published to NVD
- 2026-09-01 - Last updated in NVD database
Technical Details for CVE-2026-58106
Vulnerability Analysis
The defect resides in the build-logger wrapper ldlogger-tool-gcc.c at line 129. The prior patch for CVE-2025-40843 swapped strcpy() for a safe_strcpy() helper implemented on top of strncpy(). The helper receives a destination pointer and a size, then copies up to n bytes and NUL-pads the remainder of the destination up to n.
The caller passes fullPath + 2 as the destination and PATH_MAX (4096) as the size. The underlying fullPath buffer is PATH_MAX bytes, so only 4094 bytes remain beyond the +2 offset. strncpy() writes 4096 bytes into that 4094-byte region, overflowing the stack frame by exactly two bytes on every call.
Root Cause
The root cause is a size-argument mismatch. The offset applied to the destination pointer was not subtracted from the length passed to safe_strcpy(). Because strncpy() always writes exactly n bytes when NUL-padding is required, the overflow occurs independent of the input path. The result is an out-of-bounds write [CWE-787] on the stack.
Attack Vector
Exploitation requires local access to invoke the CodeChecker build logger. The overflow is deterministic and input-agnostic, so it triggers during normal use. The two overflowed bytes are attacker-influenced only in value (NUL padding from strncpy()), which limits practical exploitation to memory corruption of adjacent stack data such as saved registers, canaries, or nearby locals. See the GitHub Security Advisory GHSA-9gcg-v8fg-39q8 for the maintainer's technical analysis.
Detection Methods for CVE-2026-58106
Indicators of Compromise
- Unexpected crashes or stack-smashing aborts from processes named ldlogger or ldlogger-tool-gcc during CodeChecker log captures.
- Core dumps referencing safe_strcpy or ldlogger-tool-gcc.c frames.
- Build pipelines emitting *** stack smashing detected *** messages when CodeChecker is enabled.
Detection Strategies
- Inventory CodeChecker deployments and flag any version at or below 6.28.2.
- Enable compiler hardening (-fstack-protector-strong, _FORTIFY_SOURCE=2) so the overflow surfaces as an abort rather than silent corruption.
- Run the build logger under AddressSanitizer in CI to confirm the two-byte out-of-bounds write.
Monitoring Recommendations
- Ship build-host process telemetry and crash logs to a central SIEM and alert on repeated ldlogger aborts.
- Track CodeChecker package versions across developer workstations and CI runners for drift from patched releases.
- Monitor CI job exit codes and stderr for stack-protector diagnostics tied to CodeChecker invocations.
How to Mitigate CVE-2026-58106
Immediate Actions Required
- Upgrade CodeChecker to a version above 6.28.2 once the maintainers publish a fixed release.
- Restrict execution of the CodeChecker build logger to trusted local users on shared build systems.
- Rebuild the build-logger component with stack protectors and _FORTIFY_SOURCE enabled until the patch is deployed.
Patch Information
Refer to the GitHub Security Advisory GHSA-9gcg-v8fg-39q8 for the vendor's remediation guidance. The fix requires passing the remaining buffer length (PATH_MAX - 2) to safe_strcpy() rather than the full PATH_MAX, or eliminating the offset arithmetic entirely.
Workarounds
- Disable the ldlogger-based build capture path where feasible and use CodeChecker's compilation database ingestion instead.
- Isolate CodeChecker runs to ephemeral containers so stack corruption cannot pivot into persistent build infrastructure.
- Apply a local source patch that reduces the size argument at ldlogger-tool-gcc.c:129 to PATH_MAX - 2.
# Configuration example
# Verify installed CodeChecker version and gate CI on a patched release
CodeChecker version | grep -E 'Base package version'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
