CVE Daily – WeeChat (High+Critical) https://cvedaily.com/pages/tags/weechat.html CVE Daily – WeeChat (High+Critical) en Wed, 03 Jun 2026 21:27:07 +0000 [Critical] CVE-2024-46613 – WeeChat before 4.4.2 has an integer overflow and resultant buffer overflow at co... https://nvd.nist.gov/vuln/detail/CVE-2024-46613 https://nvd.nist.gov/vuln/detail/CVE-2024-46613 Sun, 10 Nov 2024 21:15:14 +0000 Critical CVE-2024-46613

WeeChat before 4.4.2 has an integer overflow and resultant buffer overflow at core/core-string.c when there are more than two billion items in a list. This affects string_free_split_shared , string_free_split, string_free_split_command, and string_free_split_tags.

CVSS: 9.8 · CWE: CWE-190

View on NVD

]]> [High] CVE-2021-40516 – WeeChat before 3.2.1 allows remote attackers to cause a denial of service (crash... https://nvd.nist.gov/vuln/detail/CVE-2021-40516 https://nvd.nist.gov/vuln/detail/CVE-2021-40516 Sun, 05 Sep 2021 18:15:07 +0000 High CVE-2021-40516

WeeChat before 3.2.1 allows remote attackers to cause a denial of service (crash) via a crafted WebSocket frame that trigger an out-of-bounds read in plugins/relay/relay-websocket.c in the Relay plugin.

CVSS: 7.5 · CWE: CWE-125

View on NVD

]]> [Critical] CVE-2020-9760 – An issue was discovered in WeeChat before 2.7.1 (0.3.4 to 2.7 are affected). Whe... https://nvd.nist.gov/vuln/detail/CVE-2020-9760 https://nvd.nist.gov/vuln/detail/CVE-2020-9760 Mon, 23 Mar 2020 16:15:17 +0000 Critical CVE-2020-9760

An issue was discovered in WeeChat before 2.7.1 (0.3.4 to 2.7 are affected). When a new IRC message 005 is received with longer nick prefixes, a buffer overflow and possibly a crash can happen when a new mode is set for a nick.

CVSS: 9.8 · CWE: CWE-120

View on NVD

]]> [Critical] CVE-2020-8955 – irc_mode_channel_update in plugins/irc/irc-mode.c in WeeChat through 2.7 allows ... https://nvd.nist.gov/vuln/detail/CVE-2020-8955 https://nvd.nist.gov/vuln/detail/CVE-2020-8955 Wed, 12 Feb 2020 22:15:13 +0000 Critical CVE-2020-8955

irc_mode_channel_update in plugins/irc/irc-mode.c in WeeChat through 2.7 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a malformed IRC message 324 (channel mode).

CVSS: 9.8 · CWE: CWE-120

View on NVD

]]> [High] CVE-2017-14727 – logger.c in the logger plugin in WeeChat before 1.9.1 allows a crash via strftim... https://nvd.nist.gov/vuln/detail/CVE-2017-14727 https://nvd.nist.gov/vuln/detail/CVE-2017-14727 Sat, 23 Sep 2017 20:29:00 +0000 High CVE-2017-14727

logger.c in the logger plugin in WeeChat before 1.9.1 allows a crash via strftime date/time specifiers, because a buffer is not initialized.

CVSS: 7.5 · CWE: CWE-119

View on NVD

]]> [High] CVE-2017-8073 – WeeChat before 1.7.1 allows a remote crash by sending a filename via DCC to the ... https://nvd.nist.gov/vuln/detail/CVE-2017-8073 https://nvd.nist.gov/vuln/detail/CVE-2017-8073 Sun, 23 Apr 2017 15:59:00 +0000 High CVE-2017-8073

WeeChat before 1.7.1 allows a remote crash by sending a filename via DCC to the IRC plugin. This occurs in the irc_ctcp_dcc_filename_without_quotes function during quote removal, with a buffer overflow.

CVSS: 7.5 · CWE: CWE-119

View on NVD

]]> [High] CVE-2012-5534 – The hook_process function in the plugin API for WeeChat 0.3.0 through 0.3.9.1 al... https://nvd.nist.gov/vuln/detail/CVE-2012-5534 https://nvd.nist.gov/vuln/detail/CVE-2012-5534 Mon, 03 Dec 2012 21:55:01 +0000 High CVE-2012-5534

The hook_process function in the plugin API for WeeChat 0.3.0 through 0.3.9.1 allows remote attackers to execute arbitrary commands via shell metacharacters in a command from a plugin, related to "shell expansion."

CVSS: 7.5 · CWE: CWE-20

View on NVD

]]> [High] CVE-2012-5854 – Heap-based buffer overflow in WeeChat 0.3.6 through 0.3.9 allows remote attacker... https://nvd.nist.gov/vuln/detail/CVE-2012-5854 https://nvd.nist.gov/vuln/detail/CVE-2012-5854 Mon, 19 Nov 2012 12:10:54 +0000 High CVE-2012-5854

Heap-based buffer overflow in WeeChat 0.3.6 through 0.3.9 allows remote attackers to cause a denial of service (crash or hang) and possibly execute arbitrary code via crafted IRC colors that are not properly decoded.

CVSS: 7.5 · CWE: CWE-119

View on NVD

]]>