Executive brief
Uncrustify, a source code beautifier and formatter, is vulnerable to a buffer overflow when processing malformed C/C++ template syntax. An attacker can provide a specially crafted source file that causes the application to crash, leading to a denial of service. This is particularly relevant for automated environments like CI/CD pipelines or online code formatters that handle untrusted code.
Technical details
A stack-based buffer overflow (CWE-121) exists in Uncrustify's template parsing logic. The vulnerability is located in the `check_template()` function within `src/tokenizer/check_template.cpp`. The parser attempts to store template-related tokens into a fixed-size stack buffer (`tokens`) without sufficient boundary validation of the `num_tokens` index. By providing a source file with deeply nested or malformed template syntax, an attacker can exceed the buffer capacity, leading to an out-of-bounds write. While arbitrary code execution has not been confirmed, the flaw reliably triggers a crash (SIGABRT/SIGSEGV) detectable by AddressSanitizer. The issue is fixed in upstream commit 68e67b9a1435a1bb173b106fedb4a4f510972bdc.
Affected products
- Uncrustify Project Uncrustify v.Uncrustify_d-0.82.0-132-bcc41cbdc and earlier
Timeline
- 2026-02-18: patched: Fix submitted via pull request 4641
- 2026-05-21: disclosed: Public disclosure and CVE assignment