Hexchat Project maintains Hexchat, an open-source Internet Relay Chat (IRC) client with a modest but established user base, whose vulnerability profile concentrates on file-handling and memory-safety issues including path traversal and buffer-boundary weaknesses. These weakness classes reflect the interaction between user-supplied input and the client's local filesystem and memory operations, common attack vectors in chat and messaging applications that process untrusted server responses and user data. Current severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Hexchat Project over time
Signals from CVEs in this vendor scope (3 CVEs).
3 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2016-2233HIGH Stack-based buffer overflow in the inbound_cap_ls function in common/inbound.c in HexChat 2.10.2 allows remote IRC servers to cause a denial of service (crash) via a large number o | Jan 18, 2017 | 7.5 | 55 | NO | YES |
CVE-2016-2087HIGH Directory traversal vulnerability in the client in HexChat 2.11.0 allows remote IRC servers to read or modify arbitrary files via a .. (dot dot) in the server name. | Jan 18, 2017 | 7.4 | 32 | NO | YES |
CVE-2013-7449MEDIUM The ssl_do_connect function in common/server.c in HexChat before 2.10.2, XChat, and XChat-GNOME does not verify that the server hostname matches a domain name in the X.509 certific | Apr 21, 2016 | 6.5 | 21 | NO | NO |
Signals from CVEs in this vendor scope (3 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Hexchat Project.
Media articles that mention a CVE ID that affects a product developed by Hexchat Project — matched by CVE ID, not by vendor name.