CVE-2012-6090: Multiple stack-based buffer overflows in the expand function in os/pl-glob.c in SWI-Prolog before 6.2.5 and...

Security readout for executives and security teams

SWI-Prolog had multiple stack buffer overflows in filename expansion before fixed releases 6.2.5 and 6.3.7. A crafted filename could crash an affected application and might allow arbitrary code execution. Business urgency depends on whether SWI-Prolog is installed and exposed to attacker-controlled filenames. Exposure is likely limited to systems running affected SWI-Prolog versions, especially applications or services that pass untrusted filenames, paths, archives, uploads, or repository contents into SWI-Prolog filename expansion behavior. Treat this as high priority where SWI-Prolog is reachable through user-controlled file or path workflows. It is older and may be absent in most environments, but affected exposed deployments carry crash risk and possible code execution risk. Mitigation focus: Upgrade SWI-Prolog to 6.2.5, 6.3.7, or later supported releases.; Check vendor and distribution advisories for backported fixes.; Avoid passing attacker-controlled filenames or paths into affected SWI-Prolog expansion paths..

Prepared

Jun 24, 2026, 12:04 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.