PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-5196 Irssi CVE debrief

CVE-2017-5196 is a denial-of-service vulnerability in Irssi that can be triggered remotely when the application processes strings that are not UTF-8. The published impact is an out-of-bounds read that can cause a crash. NVD rates the issue High with CVSS 3.0 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The affected version range in the NVD record is Irssi 0.8.18 through versions before 0.8.21.

Vendor
Irssi
Product
Unknown
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-03-03
Original CVE updated
2026-05-13
Advisory published
2017-03-03
Advisory updated
2026-05-13

Who should care

Administrators and users running Irssi versions from 0.8.18 up to, but not including, 0.8.21 should treat this as a priority availability issue, especially in environments where IRC clients are exposed to untrusted network content.

Technical summary

The NVD record describes CWE-125 out-of-bounds read behavior in Irssi when it handles strings that are not UTF-8. The result is a crash-driven denial of service rather than a documented confidentiality or integrity impact. The affected CPE range is Irssi versions start including 0.8.18 and end excluding 0.8.21.

Defensive priority

High for any environment that still runs affected Irssi releases, because the issue is network-reachable, requires no privileges, and can terminate the client process.

Recommended defensive actions

  • Upgrade Irssi to version 0.8.21 or later, per the affected-version boundary in the NVD record and vendor advisory.
  • Confirm deployed Irssi versions across desktops, servers, and automation hosts that may use the client.
  • Review vendor guidance in the Irssi security advisory and apply any package-maintainer updates referenced by downstream advisories such as Gentoo GLSA 201701-45.
  • Treat the issue as an availability risk and monitor for unexpected Irssi crashes if an immediate upgrade is not possible.
  • Use the official CVE and NVD records to verify remediation status in your asset inventory.

Evidence notes

All claims are grounded in the supplied NVD CVE record and linked advisories. The record states: remote attackers can cause a denial of service via out-of-bounds read and crash involving strings that are not UTF-8; affected versions are 0.8.18 before 0.8.21; the weakness is CWE-125. Public references in the source set include the Irssi vendor advisory, an oss-security mailing-list post, SecurityFocus BID 95310, and Gentoo GLSA 201701-45. The CVE was published on 2017-03-03, while the record was last modified on 2026-05-13; that modified timestamp reflects record updates, not a new vulnerability date.

Sources and references

Verified primary and authoritative sources

  • CVE-2017-5196 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2017-5196

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2017-5196 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2017-5196

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.