CVE-2013-7386: Format string vulnerability in the PROJECT::write_account_file function in client/cs_account.cpp in BOINC,...

Security readout for executives and security teams

BOINC had a format string flaw in account file handling. A malicious or compromised project/account source could make the client crash and may have allowed code execution. The public record does not provide CVSS scoring, clear affected-version range, or evidence of active exploitation. Exposure is most likely on systems running BOINC clients that process account files containing attacker-controlled gui_urls data. The bundle only says BOINC, possibly 7.2.33, so organizations should verify exact package versions against vendor records. Treat this as a targeted remediation item, not an emergency absent exploitation evidence. Patch BOINC where deployed, especially in research or distributed-computing environments that interact with external projects. Mitigation focus: Apply BOINC updates from the upstream fix or Fedora vendor advisories where applicable.; Check current BOINC vendor guidance for affected versions and supported patches.; Avoid connecting BOINC clients to untrusted projects or account sources..

Prepared

Jun 14, 2026, 14:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.