CVE-2017-1000373: The OpenBSD qsort() function is recursive, and not randomized, an attacker can construct a pathological inp...

Security readout for executives and security teams

CVE-2017-1000373 is a flaw in OpenBSD's qsort() implementation. A specially shaped input can force excessive recursion, consuming stack memory and potentially helping code execution attacks. The bundle names OpenBSD 6.1 and possibly earlier versions; broader affected-product evidence is incomplete. Most exposure is likely on systems or software using OpenBSD 6.1 or possibly earlier libc qsort(). The provided Apple links confirm related vendor advisories, but the bundle does not identify exact Apple affected products or versions. Prioritize remediation where legacy OpenBSD-derived systems process untrusted input. Business urgency is elevated by possible code-execution assistance and public exploit material, but tempered by incomplete affected-product data and no KEV listing. Mitigation focus: Identify OpenBSD 6.1 and earlier systems in asset inventory.; Check OpenBSD vendor guidance and qsort.c revision history for corrective updates.; Apply supported operating system security updates from affected vendors..

Prepared

Jun 13, 2026, 04:43 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.