# CVE-2015-8972: GNU Chess stack buffer overflow in ValidateMove function

Source: https://junglewise.ai/threats/cve-2015-8972-gnu-chess-stack-buffer-overflow-in-validatemove-function  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-23. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2015-8972 · Severity: critical · CVSS 9.8 · Published 2017-01-23

GNU Chess is a popular open-source chess engine used for playing and analyzing chess games. A security vulnerability in the way it handles move inputs allows an attacker to crash the application or potentially take control of the system. This is particularly risky if the engine is used as a backend for a web-based chess service or other networked applications.

Vendors: [Gnu](https://junglewise.ai/threats/vendors/gnu).

## Quick answers

**Is CVE-2015-8972 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2015-8972 being exploited in the wild.

**How severe is CVE-2015-8972?** Critical severity, with a CVSS score of 9.8, published 23 January 2017.

**Which products and versions are affected?** GNU GNU Chess before 6.2.4.

**Is there a fix for CVE-2015-8972?** A patch was published on 2016-09-20: Fix committed to Savannah SVN repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2015-8972 attacked?** It is attacked over the network or with local access, in a software library.

**Am I affected by CVE-2015-8972?** Check whether you run Gnu Chess. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow exists in the ValidateMove function within frontend/move.cc of GNU Chess (gnuchess). The vulnerability is caused by insufficient bounds checking when copying user-supplied move strings into a fixed-size buffer (MAXSTR, typically 128 bytes). While gnuchess is often used locally, the vulnerability can be exploited remotely if the engine is running in Universal Chess Interface (UCI) mode as a backend for a network-accessible service. An attacker providing a move string longer than the buffer can overwrite the stack, leading to a denial of service (crash) or arbitrary code execution. The issue was addressed in version 6.2.4 by adding a length check and null-terminating long inputs.

## Affected products

- GNU GNU Chess before 6.2.4

## Timeline

- 2015-10-29: disclosed: Initial bug report by Antti Karjalainen on the bug-gnu-chess mailing list
- 2016-09-20: patched: Fix committed to Savannah SVN repository
- 2016-11-14: advisory: CVE-2015-8972 assigned via oss-security mailing list
- 2017-01-23: other: NVD publication date

## References

- [http://lists.gnu.org/archive/html/bug-gnu-chess/2015-10/msg00002.html](http://lists.gnu.org/archive/html/bug-gnu-chess/2015-10/msg00002.html)
- [http://svn.savannah.gnu.org/viewvc/chess?revision=134&view=revision](http://svn.savannah.gnu.org/viewvc/chess?revision=134&view=revision)
- [http://www.openwall.com/lists/oss-security/2016/11/13/2](http://www.openwall.com/lists/oss-security/2016/11/13/2)
- [http://www.openwall.com/lists/oss-security/2016/11/14/11](http://www.openwall.com/lists/oss-security/2016/11/14/11)
- [http://www.openwall.com/lists/oss-security/2016/11/14/12](http://www.openwall.com/lists/oss-security/2016/11/14/12)