CVE-2008-1391

no score yetEPSS 19%

Multiple integer overflows in libc in NetBSD 4.x, FreeBSD 6.x and 7.x, and probably other BSD and Apple Mac OS platforms allow context-dependent attackers to execute arbitrary code via large values of certain integer fields in the format argument to (1) the strfmon function in lib/libc/stdlib/strfmon.c, related to the GET_NUMBER macro; and (2) the printf function, related to left_prec and right_prec.

EPSS: 19% chance of exploitation in the next 30 days; higher than 97% of CVEs (scores of 2026-10-31)
CWE: CWE-189
Published: 2008-03-27
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

freebsd:freebsd
netbsd:netbsd

References

http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libc/stdlib/strfmon.c
http://lists.apple.com/archives/security-announce//2008//Dec/msg00000.html
http://secunia.com/advisories/29574
http://secunia.com/advisories/33179
http://securityreason.com/achievement_securityalert/53

Check your stack JSON