The vulnerability exists in proxychains-ng's proxy_from_string() function in src/libproxychains.c, where fixed-size stack buffers are overflowed by crafted proxy configuration entries containing overly long username or password fields. This stack-based buffer overflow (CWE-121) can cause memory corruption or crashes, potentially enabling denial of service or further exploitation depending on the execution context. The affected versions include all releases up to 4.17 and prior to commit cc005b7. The CVSS 4.0 vector indicates local attack vector with low complexity and no privileges or user interaction required, but high impact on availability.

Exploitation of this vulnerability can cause application crashes leading to denial of service. Under certain conditions, it may allow attackers to execute arbitrary code or other forms of exploitation depending on the environment and existing mitigations. There are no known exploits in the wild at this time. The medium severity reflects the potential for significant disruption but limited remote attack feasibility.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix links are provided in the available data. Users should monitor for updates from the rofl0r project and avoid using untrusted proxy configuration entries with overly long username or password fields as a temporary precaution.