An out-of-bounds write vulnerability exists in the handling of the MXIT protocol in Pidgin.

Published 9 y ago 2017-01-06 · modified 4 mo ago 2026-06-17 · JSON

CVSS

8.1

v3.0 · NVD

CISA KEV

not known exploited

EPSS

3.2%

percentile 88%

Public exploits

none known

An out-of-bounds write vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could cause memory corruption resulting in code execution.

Exploit prediction (EPSS)

3.16% probability of exploitation in the next 30 days, higher than 88% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	8.1	`CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`
NVD	2.0	6.8	`AV:N/AC:M/Au:N/C:P/I:P/A:P`

Affected products

Pidgin Pidgin

Classification

Weakness

CWE-787 Out-of-bounds Write

References

securityfocus.com /bid/91335 · vdb-entry, x_refsource_BID, x_transferred
pidgin.im /news/security/?id=104 · x_refsource_CONFIRM, x_transferred
talosintelligence.com /reports/TALOS-2016-0139/ · x_refsource_MISC, x_transferred
debian.org /security/2016/dsa-3620 · vendor-advisory, x_refsource_DEBIAN, x_transferred
security.gentoo.org /glsa/201701-38 · vendor-advisory, x_refsource_GENTOO, x_transferred
ubuntu.com /usn/USN-3031-1 · vendor-advisory, x_refsource_UBUNTU, x_transferred

Sources

CVE List: CVE-2016-2371
NVD: CVE-2016-2371

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.