CVE-2012-6089: Multiple stack-based buffer overflows in the canoniseFileName function in os/pl-os.c in SWI-Prolog before 6...

Security readout for executives and security teams

SWI-Prolog had stack buffer overflows in filename canonicalisation before fixed 6.2.5 and 6.3.7 releases. If an exposed application lets users influence filenames, a crafted filename could crash the process and may allow code execution. Treat internet-facing or automation-facing Prolog services as higher priority. Exposure is most likely where SWI-Prolog or pl processes handle untrusted filenames, paths, uploads, generated file references, or user-controlled project paths. Internal batch systems may still be exposed if they process external data. General installations with no untrusted filename input have lower practical exposure. Prioritize remediation for systems where SWI-Prolog processes external files or paths. The main confirmed risk is service crash, with possible code execution noted by the CVE. Lack of KEV evidence lowers emergency pressure, but legacy vulnerable versions should not remain in exposed workflows. Mitigation focus: Upgrade SWI-Prolog to 6.2.5, 6.3.7, or a later supported release.; Prioritize exposed services that pass user-controlled filenames to SWI-Prolog.; Check distribution advisories, including Red Hat guidance, for packaged fixed versions..

Prepared

Jun 24, 2026, 12:04 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.