This vulnerability exists in the s_vlog function of stunnel, where handling of oversized log messages via vsnprintf can cause a stack-based out-of-bounds read. When a log message exceeds 1024 bytes, the function reads beyond the stack buffer, potentially causing a crash. In some cases, trailing newline characters may be replaced with null terminators. The flaw can be triggered remotely by an unauthenticated attacker with network access to a stunnel service, notably during IMAP protocol negotiation when 'protocol = imap' is configured. The vulnerability affects stunnel versions up to and including 5.79. While denial-of-service is the primary impact, reliable integrity or code execution impact is considered very difficult and unlikely. The vulnerability is tracked as CWE-125 (Out-of-bounds Read).

An attacker with network access to a vulnerable stunnel service can cause a denial-of-service by triggering a crash via oversized log messages. The vulnerability does not allow confidentiality compromise but may cause low integrity impact by altering trailing newline characters in logs. Code execution or reliable integrity compromise is considered very difficult and impractical. The primary impact is availability degradation due to service crashes.

No official patch or fix is currently confirmed. To mitigate this vulnerability, restrict access to stunnel services to trusted networks only and avoid exposing them to untrusted clients. Monitor vendor advisories for updates on patches or official fixes. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.