Xchat is a narrowly scoped IRC client that, despite limited product breadth, has occupied a notable place in the landscape of lightweight chat applications and remains embedded in certain deployment contexts. Its vulnerability profile centers on the core xchat and xchat-gnome products and recurs through memory-safety and code-injection weakness classes—including buffer-boundary violations, NULL-pointer dereferences, out-of-bounds writes, and code-injection conditions—that reflect the parsing demands of IRC protocol handling in a native codebase. Vulnerabilities affecting the vendor lean toward serious outcomes and frequently acquire public exploit code; live severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Xchat over time
Signals from CVEs in this vendor scope (12 CVEs).
12 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2004-0409HIGH Stack-based buffer overflow in the Socks-5 proxy code for XChat 1.8.0 to 2.0.8, with socks5 traversal enabled, allows remote attackers to execute arbitrary code. | Jun 1, 2004 | 7.5 | 38 | NO | YES |
CVE-2008-2841MEDIUM Argument injection vulnerability in XChat 2.8.7b and earlier on Windows, when Internet Explorer is used, allows remote attackers to execute arbitrary commands via the --command par | Jun 24, 2008 | 6.8 | 33 | NO | YES |
CVE-2012-0828CRITICAL Heap-based buffer overflow in Xchat-WDK before 1499-4 (2012-01-18) xchat 2.8.6 on Maemo architecture could allow remote attackers to cause a denial of service (xchat client crash) | Feb 21, 2020 | 9.8 | 32 | NO | NO |
CVE-2000-0787HIGH IRC Xchat client versions 1.4.2 and earlier allows remote attackers to execute arbitrary commands by encoding shell metacharacters into a URL which XChat uses to launch a web brows | Oct 20, 2000 | 7.5 | 32 | NO | YES |
CVE-2002-0006HIGH XChat 1.8.7 and earlier, including default configurations of 1.4.2 and 1.4.3, allows remote attackers to execute arbitrary IRC commands as other clients via encoded characters in a | Jun 25, 2002 | 7.5 | 31 | NO | YES |
CVE-2011-5129MEDIUM Heap-based buffer overflow in XChat 2.8.9 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long response string. | Aug 30, 2012 | 5.0 | 28 | NO | YES |
CVE-2006-4455MEDIUM Unspecified vulnerability in Xchat 2.6.7 and earlier allows remote attackers to cause a denial of service (crash) via unspecified vectors involving the PRIVMSG command. NOTE: the | Aug 30, 2006 | 5.0 | 24 | NO | YES |
CVE-2013-7449MEDIUM The ssl_do_connect function in common/server.c in HexChat before 2.10.2, XChat, and XChat-GNOME does not verify that the server hostname matches a domain name in the X.509 certific | Apr 21, 2016 | 6.5 | 21 | NO | NO |
CVE-2003-1000HIGH xchat 2.0.6 allows remote attackers to cause a denial of service (crash) via a passive DCC request with an invalid ID number, which causes a null dereference. | Jan 5, 2004 | 7.5 | 21 | NO | NO |
CVE-2002-0382HIGH XChat IRC client allows remote attackers to execute arbitrary commands via a /dns command on a host whose DNS reverse lookup contains shell metacharacters. | Jun 25, 2002 | 7.5 | 20 | NO | NO |
Signals from CVEs in this vendor scope (12 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Xchat.
Media articles that mention a CVE ID that affects a product developed by Xchat — matched by CVE ID, not by vendor name.