CVE-2017-1000378: The NetBSD qsort() function is recursive, and not randomized, an attacker can construct a pathological inpu...

Security readout for executives and security teams

NetBSD's qsort() implementation can be driven into excessive recursion by specially shaped input. On affected NetBSD systems, this can exhaust stack memory and may help an attacker prepare a broader memory-corruption attack. The bundle does not show active exploitation or a confirmed fixed release. Exposure is most likely on NetBSD 7.1 or earlier systems, or software built against affected NetBSD libc that sorts attacker-influenced arrays. The source bundle does not identify other operating systems or third-party products. Treat as high priority for NetBSD estates, especially internet-facing or privileged services. Business urgency is lower if no affected NetBSD systems exist. Because patch details are incomplete in the bundle, remediation should start with vendor verification rather than assumed fixes. Mitigation focus: Check NetBSD vendor guidance for fixed libc or base-system updates.; Prioritize NetBSD 7.1 and earlier hosts for review.; Reduce attacker control over data sorted by privileged services..

Prepared

Jun 13, 2026, 04:43 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.