PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-5356 Debian CVE debrief

CVE-2017-5356 affects Irssi before 0.8.21. A remote attacker can trigger a denial of service by sending a string that includes the formatting sequence "%[" without a closing "]", which leads to an out-of-bounds read and a crash. The NVD CVSS vector rates the issue as high severity because it is network-reachable, requires no privileges or user interaction, and fully impacts availability.

Vendor
Debian
Product
CVE-2017-5356
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-03-03
Original CVE updated
2026-05-13
Advisory published
2017-03-03
Advisory updated
2026-05-13

Who should care

Administrators, users, and package maintainers responsible for Irssi deployments should prioritize this issue, especially where older versions may still be in use. It is most relevant for any environment that exposes Irssi to untrusted remote input.

Technical summary

The supplied advisory data describes a format-string parsing bug in Irssi versions before 0.8.21. A malformed string containing "%[" without a matching closing bracket can drive an out-of-bounds read (CWE-125), causing the client to crash. The published CVSS 3.0 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating a remotely triggerable availability-only denial of service.

Defensive priority

High

Recommended defensive actions

  • Upgrade Irssi to version 0.8.21 or later.
  • Verify packaged or embedded Irssi builds are not still shipping affected versions.
  • Use the vendor advisory and downstream distribution notices to confirm remediation status.
  • Treat unexpected crashes in affected clients as a security signal and investigate whether malformed remote input was involved.

Evidence notes

The CVE description states the issue affects Irssi before 0.8.21 and can be triggered by a string containing "%[" without a closing "]", causing an out-of-bounds read and crash. NVD supplies the CVSS 3.0 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H and classifies the weakness as CWE-125. Reference metadata includes an Irssi vendor advisory, oss-security mailing list posts, a technical write-up, and a Debian LTS notice; no additional reference contents were assumed beyond the supplied corpus.

Official resources

The issue was publicly referenced in January 2017 through upstream and mailing-list advisories, and the CVE record was published on 2017-03-03. The record was later modified on 2026-05-13, but that is a record update date rather than the CV