GoAccess 1.10.2 contains a heap-based buffer overflow in the parse_browser function. The function assumes the matched browser token begins with 'Opera' and moves a trailing version substring to match plus five, which allows a specially crafted User-Agent string in an access log to write one to four bytes beyond the allocated heap buffer. This memory corruption can cause application crashes or other unintended behavior. The vulnerability is identified as CWE-122 (Heap-based Buffer Overflow) and CWE-787 (Out-of-bounds Write). The issue is resolved in GoAccess version 1.11.

An attacker can exploit this vulnerability by supplying a crafted User-Agent string in an access log processed by GoAccess 1.10.2, causing heap corruption that may crash the application or lead to other unpredictable behavior. There is no indication of remote code execution or privilege escalation from the provided data. The CVSS 4.0 score is 7.1 (high), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on availability.

Upgrade GoAccess to version 1.11 or later, where this heap-based buffer overflow vulnerability is fixed. No other mitigation or workaround is indicated in the available data. Patch status is confirmed fixed in version 1.11.