CVE-2025-70085
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedAn issue was discovered in OpenSatKit 2.2.1. The EventErrStr buffer has a fixed size of 256 bytes. The code uses sprintf to format two filenames (Source1Filename and the string returned by FileUtil_FileStateStr) into this buffer without any length checking and without using bounded format specifiers such as %.*s. If the filename length approaches OS_MAX_PATH_LEN (commonly 64-256 bytes), the combined formatted string together with constant text can exceed 256 bytes, resulting in a stack buffer overflow. Such unsafe sprintf calls are scattered across multiple functions in file.c, including FILE_ConcatenateCmd() and ConcatenateFiles(), all of which fail to validate the output length.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceStack-based buffer overflow in OpenSatKit 2.2.1 file.c where a fixed 256-byte EventErrStr buffer is used with unbounded sprintf() to format Source1Filename and FileUtil_FileStateStr output without length validation. When filenames approach OS_MAX_PATH_LEN (64-256 bytes), the formatted string exceeds the buffer size causing overflow in functions including FILE_ConcatenateCmd() and ConcatenateFiles().
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data= 2.2.1CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Verify OpenSatKit installationLocate the OpenSatKit installation directory and identify the file.c source file in the codebaseAffected if OpenSatKit is installed and file.c exists with the vulnerable sprintf code
-
Confirm OpenSatKit versionCheck the version of installed OpenSatKit against 2.2.1 - look for version files, headers, or executable version stringsAffected if Installed version is exactly 2.2.1
-
Identify vulnerable file.cSearch for file.c containing the sprintf call with EventErrStr buffer and FileUtil_FileStateStr - look for the pattern sprintf(EventErrStr, ...) concatenating Source1FilenameAffected if file.c contains the unsanitized sprintf call to EventErrStr buffer (256 bytes)
-
Check for concatenation command usageInspect if the FILE_ConcatenateCmd() or ConcatenateFiles() functions are invoked - check command tables, configuration, or runtime logs for file concatenation operationsAffected if The file concatenation feature (FILE_ConcatenateCmd/ConcatenateFiles) is enabled or used in the deployment
-
Verify buffer configurationConfirm OS_MAX_PATH_LEN is configured at 64-256 bytes in the environment - check header files or build configuration for the path length limit settingAffected if OS_MAX_PATH_LEN allows paths large enough (64-256 bytes) to overflow the 256-byte EventErrStr when concatenated with constant text
OpenSatKit 2.2.1 is affected if file.c with the vulnerable sprintf is present AND the file concatenation feature (FILE_ConcatenateCmd/ConcatenateFiles) is used, allowing filenames to trigger the 256-byte buffer overflow in EventErrStr.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
From vendor dataReplace all unbounded sprintf() calls with snprintf() using %.*s format specifiers or add explicit length validation before formatting to prevent buffer overflow.
- Consultation3.0 h
- Implementation6.0 h
- Testing3.0 h
- Review / QA3.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $4,272.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2025-70085 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2025-70085 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data