CVE-2016-9422

What it actually does

Improper validation of table span attribute values in feed_table_tag allows stack or heap buffer overflow when parsing crafted HTML, leading to memory corruption that can result in denial of service or arbitrary code execution.

Why it matters to the business

Attackers can crash or take control of systems processing untrusted web content, leading to service disruption or compromise; the vulnerability is present in long-deployed cadvisor packages but has seen no observed exploitation or ransomware use despite years of public availability.

How an attack unfolds

An attacker creates a malicious HTML page containing a table with an oversized or malformed span attribute, then delivers it to a victim application that uses the vulnerable w3m parsing code; when the page is rendered, the buffer overflow occurs and the attacker gains control or causes a crash.

How to fix it

Upgrade affected cadvisor packages to the fixed versions 0.49.1-r7 (Chainguard) or 0.49.1-r7 (Wolfi) and rebuild or redeploy any containers using the patched images.

How to confirm the fix worked

Confirm package versions match the fixed releases, then test parsing of a crafted HTML table containing an extreme span attribute to verify the overflow condition is no longer triggered.

Typical attack path

1. Craft malicious HTML with invalid table span value
2. Host or embed the page in a location reachable by the target application
3. Trigger rendering or parsing of the page inside the vulnerable w3m component
4. Exploit resulting memory corruption to execute code or crash the process

How to detect it

Review application logs for crashes or segmentation faults during HTML parsing; because the vulnerability is old and has no known exploitation campaigns, focus on historical crash artifacts or memory dumps rather than active indicators.

What your security team should do

• Immediately update cadvisor to the stated fixed versions across all environments
• Audit container images for any remaining older w3m or cadvisor dependencies
• Add HTML parsing of untrusted content to the list of high-risk operations requiring sandboxing or isolation