CVE-2010-2947: Jan Engelhardt Libhx

High severity, CVSS 10.0. EPSS: 5.5% chance of exploitation in the next 30 days.

Heap-based buffer overflow in the HX_split function in string.c in libHX before 3.6 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a string that is inconsistent with the expected number of fields.

Affected products

• Jan Engelhardt Libhx: up to and including 3.5; version 1.10.0 only; version 1.10.1 only; version 1.10.2 only; version 1.15 only; version 1.17 only; …

Published 2010-08-24. Last modified 2026-06-16.