The core issue in CVE-2026-70368 is a composition failure, not a direct format string bug. The stunnel codebase uses vsnprintf with a 1024-byte buffer as a defensive measure—developers understood format string risks and added bounds-checking. But when truncation occurs, downstream code replaces trailing newlines with null terminators, operating on assumptions about string structure that no longer hold after vsnprintf cuts the output. This is the critical failure: defensive code at layer A broke an implicit invariant at layer B.
Two factors should sharpen your prioritization. First, the CVSS 6.5 rating understates the actual risk because it treats a crash as equivalent to a data leak. A stack-based out-of-bounds read in stunnel's logging path can expose TLS session material, key negotiation state, or upstream credentials sitting in stack frames—the blast radius extends beyond the proxy to whatever it protects. Second, the low EPSS score (0.00353) may reflect narrow trigger conditions, but stunnel's role as a TLS terminator means this code path processes data after decryption and authentication. If s_vlog is only reachable through authenticated connection paths (a plausible architectural constraint that may have accumulated silently over years), the actual attack surface is narrower than the CVE's 'remote network access' language suggests—but no less severe for the data that could leak.
The 1024-byte limit appears to be an undocumented internal invariant with no config flag or API enforcement. This is the real vulnerability class: not just the vsnprintf-to-string-op composition, but the invisible contract that makes it dangerous. No logging indicates when truncation occurs; the downstream code processes truncated input as valid, silently.
Audit your stunnel deployment specifically: check whether logging verbosity settings can produce messages exceeding 1024 bytes from authenticated sources, and verify whether the s_vlog calling path still requires authentication or has been restricted by prior refactoring. If you're maintaining similar TLS proxy or daemon code, scan for the pattern—bounds-checked format functions feeding string operations that assume complete output. This composition failure is recurrent enough that static analysis tools are now flagging it systematically.