CVE-2004-1052: Bnc

High severity, CVSS 10.0. EPSS: 3.6% chance of exploitation in the next 30 days.

Buffer overflow in the getnickuserhost function in BNC 2.8.9, and possibly other versions, allows remote IRC servers to execute arbitrary code via an IRC server response that contains many (1) ! (exclamation) or (2) @ (at sign) characters.

Affected products

• Bnc Bnc: version 2.2.4 only; version 2.4.6 only; version 2.4.8 only; version 2.6 only; version 2.6.2 only; version 2.6.4 only; …
• Debian Debian Linux: version 3.0 only
• Gentoo Linux: any version

Published 2005-03-01. Last modified 2026-06-16.