CVE-2013-7049: Stack-based buffer overflow in fish.cpp in the Fish plugin for ZNC, as used in ZNC for Windows (znc-msvc) 0...

Security readout for executives and security teams

This issue affects the FiSH plugin in legacy ZNC for Windows builds. A remote attacker could send an oversized DH1080_INIT message and crash the IRC bouncer. The cited sources describe denial of service, not confirmed code execution or active exploitation. Exposure is most likely in legacy Windows ZNC deployments using znc-msvc 0.206 or earlier with the Fish plugin enabled. Modern ZNC deployments, non-Windows builds, or installations without the plugin are not shown as affected by the supplied sources. Treat this as a targeted availability risk for legacy IRC infrastructure. Prioritize if ZNC supports operational communications, is internet-facing, or remains on unsupported Windows builds. Otherwise handle through normal legacy software retirement and exposure reduction. Mitigation focus: Identify any znc-msvc 0.206 or earlier installations.; Check vendor or project guidance for fixed builds or retirement advice.; Disable or remove unused Fish plugin exposure where operationally acceptable..

Prepared

Jun 14, 2026, 15:13 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.