CVE-2017-5196 Irssi CVE debrief

Who should care

Administrators and users running Irssi versions from 0.8.18 up to, but not including, 0.8.21 should treat this as a priority availability issue, especially in environments where IRC clients are exposed to untrusted network content.

Technical summary

The NVD record describes CWE-125 out-of-bounds read behavior in Irssi when it handles strings that are not UTF-8. The result is a crash-driven denial of service rather than a documented confidentiality or integrity impact. The affected CPE range is Irssi versions start including 0.8.18 and end excluding 0.8.21.

Defensive priority

High for any environment that still runs affected Irssi releases, because the issue is network-reachable, requires no privileges, and can terminate the client process.

Recommended defensive actions

• Upgrade Irssi to version 0.8.21 or later, per the affected-version boundary in the NVD record and vendor advisory.
• Confirm deployed Irssi versions across desktops, servers, and automation hosts that may use the client.
• Review vendor guidance in the Irssi security advisory and apply any package-maintainer updates referenced by downstream advisories such as Gentoo GLSA 201701-45.
• Treat the issue as an availability risk and monitor for unexpected Irssi crashes if an immediate upgrade is not possible.
• Use the official CVE and NVD records to verify remediation status in your asset inventory.

Evidence notes

All claims are grounded in the supplied NVD CVE record and linked advisories. The record states: remote attackers can cause a denial of service via out-of-bounds read and crash involving strings that are not UTF-8; affected versions are 0.8.18 before 0.8.21; the weakness is CWE-125. Public references in the source set include the Irssi vendor advisory, an oss-security mailing-list post, SecurityFocus BID 95310, and Gentoo GLSA 201701-45. The CVE was published on 2017-03-03, while the record was last modified on 2026-05-13; that modified timestamp reflects record updates, not a new vulnerability date.

Official resources