PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-5356 Debian CVE debrief

CVE-2017-5356 affects Irssi before 0.8.21. A remote attacker can trigger a denial of service by sending a string that includes the formatting sequence "%[" without a closing "]", which leads to an out-of-bounds read and a crash. The NVD CVSS vector rates the issue as high severity because it is network-reachable, requires no privileges or user interaction, and fully impacts availability.

Vendor
Debian
Product
Unknown
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-03-03
Original CVE updated
2026-05-13
Advisory published
2017-03-03
Advisory updated
2026-05-13

Who should care

Administrators, users, and package maintainers responsible for Irssi deployments should prioritize this issue, especially where older versions may still be in use. It is most relevant for any environment that exposes Irssi to untrusted remote input.

Technical summary

The supplied advisory data describes a format-string parsing bug in Irssi versions before 0.8.21. A malformed string containing "%[" without a matching closing bracket can drive an out-of-bounds read (CWE-125), causing the client to crash. The published CVSS 3.0 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating a remotely triggerable availability-only denial of service.

Defensive priority

High

Recommended defensive actions

  • Upgrade Irssi to version 0.8.21 or later.
  • Verify packaged or embedded Irssi builds are not still shipping affected versions.
  • Use the vendor advisory and downstream distribution notices to confirm remediation status.
  • Treat unexpected crashes in affected clients as a security signal and investigate whether malformed remote input was involved.

Evidence notes

The CVE description states the issue affects Irssi before 0.8.21 and can be triggered by a string containing "%[" without a closing "]", causing an out-of-bounds read and crash. NVD supplies the CVSS 3.0 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H and classifies the weakness as CWE-125. Reference metadata includes an Irssi vendor advisory, oss-security mailing list posts, a technical write-up, and a Debian LTS notice; no additional reference contents were assumed beyond the supplied corpus.

Sources and references

Verified primary and authoritative sources

  • CVE-2017-5356 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2017-5356

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2017-5356 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2017-5356

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.