CVE-2024-46613

What it actually does

Integer overflow in core/core-string.c triggers buffer overflow in string_free_split_shared, string_free_split, string_free_split_command, and string_free_split_tags when a list exceeds two billion items.

Why it matters to the business

Unpatched WeeChat instances risk denial of service or remote code execution during parsing of unusually large command, tag, or split lists, potentially disrupting user workflows in chat and scripting environments.

How an attack unfolds

An attacker supplies or triggers input that results in a split list containing more than two billion elements, causing the integer overflow during free operations and subsequent buffer overflow that can be leveraged for memory corruption.

How to fix it

Upgrade WeeChat to a build containing commit 26da6bda4d4cf166844e96e1f35b57231ced13a5 or later (equivalent to version 4.4.2 or newer).

How to confirm the fix worked

Confirm the installed WeeChat binary or source is at or beyond commit 26da6bda4d4cf166844e96e1f35b57231ced13a5 and that the vulnerable string_free_split functions no longer exhibit the overflow condition under large-list test cases.

Typical attack path

1. Identify or craft input that forces WeeChat to build an extremely large split list via commands, tags, or shared strings
2. Trigger the affected free functions on that list
3. Exploit the resulting integer-to-buffer overflow for memory corruption or control-flow hijack

How to detect it

Search process and application logs for repeated invocations of string split/free routines under high item counts; correlate with any crashes or memory corruption signals in WeeChat.

What your security team should do

• Immediately upgrade all WeeChat installations to the fixed commit or 4.4.2+
• Monitor for any custom builds or downstream packages that may lag behind the upstream fix
• Review logs for unusual command or tag volumes that could indicate attempted trigger conditions