LiveActive security incident?Get immediate response
CVE Record

CVE-2016-2090: Off-by-one vulnerability in the fgetwln function in libbsd before 0.8.2 allows attackers to have unspecifie...

Off-by-one vulnerability in the fgetwln function in libbsd before 0.8.2 allows attackers to have unspecified impact via unknown vectors, which trigger a heap-based buffer overflow.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2016-2090 is an old memory-corruption flaw in libbsd. A bug in fgetwln can cause a heap buffer overflow, but the public record describes the impact and attack vectors as unspecified. Treat it as patch hygiene unless libbsd is exposed through software processing untrusted input.

Executive priority

Prioritize remediation during normal vulnerability maintenance, faster for internet-facing or input-parsing services using vulnerable libbsd. The business risk is uncertain but credible because heap overflows can become serious, while evidence of exploitation is absent in the provided sources.

Technical view

The issue is an off-by-one error in libbsd fgetwln before 0.8.2, leading to heap-based buffer overflow. Public sources cite an upstream fix and multiple Linux distribution advisories. The CVE record provides no CVSS, CWE, concrete affected product list, or detailed exploitation conditions.

Likely exposure

Exposure is most likely on Linux systems or products carrying libbsd before 0.8.2, especially applications that call fgetwln on attacker-controlled data. The provided affected-product metadata is incomplete, so validate by package inventory rather than product names alone.

Exploitation context

The source bundle does not show CISA KEV listing, active exploitation, public weaponization, or confirmed real-world attacks. The vulnerability was reported through fuzzing-related public disclosure and later addressed by upstream and distribution security updates.

Researcher notes

Key gaps are unspecified impact, unknown vectors, missing CVSS, and incomplete affected-product metadata. The strongest evidence is the upstream libbsd commit plus Fedora, Gentoo, Debian LTS, and Ubuntu advisories. Avoid asserting exploitability beyond heap overflow without additional primary evidence.

Mitigation direction

  • Inventory systems and builds for libbsd usage and versions.
  • Upgrade libbsd using applicable vendor security updates.
  • Use libbsd 0.8.2 or later where version-based remediation applies.
  • Check Fedora, Gentoo, Debian, and Ubuntu advisories for package-specific fixed releases.
  • For custom builds, confirm they include the upstream fgetwln fix.

Validation and detection

  • Verify installed libbsd versions are not vulnerable.
  • Confirm relevant distribution security advisories are applied.
  • Review applications that process untrusted input through libbsd interfaces.
  • Check custom or statically bundled libbsd copies separately.
  • Document unsupported systems that cannot receive vendor fixes.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2016-2090 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
9Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.