CVE-2010-3846: Nongnu Cvs

Medium severity, CVSS 6.9. EPSS: 0.4% chance of exploitation in the next 30 days.

Array index error in the apply_rcs_change function in rcs.c in CVS 1.11.23 allows local users to gain privileges via an RCS file containing crafted delta fragment changes that trigger a heap-based buffer overflow.

Affected products

• Nongnu Cvs: version 1.11.23 only

Published 2010-11-05. Last modified 2026-06-16.