Executive brief
SpaceSniffer, a tool used to visualize disk space usage, is vulnerable to a security flaw when opening specially crafted snapshot files. An attacker could trick a user into opening a malicious .sns file, allowing the attacker to take control of the user's computer and execute unauthorized commands. This could lead to the theft of sensitive data or a complete system compromise depending on the user's permissions.
Technical details
A stack-based buffer overflow (CWE-121) exists in Uderzo Software SpaceSniffer v.2.0.5.18 within the snapshot import functionality. The vulnerability is located in the function `TFileSystemNode::importHardCoded_internal`, where the application reads a 32-bit length value from a proprietary .sns file and uses it as the size argument for an `fread()` call into a fixed 8192-byte stack buffer without bounds checking. An attacker can exploit this by providing a crafted snapshot file via social engineering (email, chat, or download). Successful exploitation allows for arbitrary code execution in the context of the current user; a PoC demonstrated a DEP bypass using ROP to execute a MessageBoxW call. The issue is resolved in version 2.1.0.21.
Affected products
- Uderzo Software SpaceSniffer 2.0.5.18
Timeline
- 2026-03-10: disclosed
- 2026-03-10: advisory
- 2026-03-10: patched: Fixed in version 2.1.0.21