NewsCSO Online

    17 old software bugs that took way too long to squash

    Share
    In 2021, a vulnerability was revealed in a system that lay at the foundation of modern computing. An attacker could force the system to execute arbitrary code. Shockingly, the vulnerable code was almost 54 years old — and there was no patch available, and no expectation that one would be forthcoming. Fortunately, that’s because the system in question was Marvin Minsky’s 1967 implementation of a Universal Turing Machine , which, despite its momentous theoretical importance for the field of computer science, had never actually been built into a real-world computer. But in the decade or so after Minsky’s design, the earliest versions of Unix and DOS came into use, and their descendants are still with us today in the 21st century. Some of those systems have had bugs lurking beneath the surface for years or even decades. Frontier AI tools such as Claude Mythos are making it much easier to uncover latent vulnerabilities at pace since discovery is no longer limited by human attention span or manual triage speed. The resulting acceleration on flaw discovery is possible not because AI tools are uncovering new exploit classes but because they are able to scan, chain reasoning, and test exploit paths at machine speed. Here are 17 noteworthy bugs that, once long dormant, took over a decade to be discovered and fixed — in descending order of how long they went unaddressed. Libpng graphics library flaw Age: 30 years Date introduced: 1995 Date fixed: February 2026 Researchers unearthed a legacy flaw in the widely used libpng open-source library that had existed since the technology was first released more than 30 years ago. The heap buffer overflow vulnerability ( CVE-2026-25646 ) meant that applications using the flawed software would crash when presented with a maliciously constructed PNG raster image file. Although difficult to exploit, the vulnerability potentially poses an information disclosure or remote code execution risk. The vulnerable png_set_quantize function, previously called png_set_dither, is rarely used. This in combination with the difficulty of exploitation mean that the flaw earns a CVSS score of 8.3, rating it as a “high” rather than “critical” risk. Nonetheless many Linux distributions (Debian, Red Hat, Ubuntu), desktop apps, and some Java runtimes rely on vulnerable versions of the library and need to be patched. PrintDemon Age: 24 years Date introduced: 1996 Date fixed: May 2020 Printers are a frequent pain point for IT because there are a lot of models, they aren’t made by the same vendors who make computers and operating systems, and users expect to plug them in and start printing. Microsoft in its early years battled to make installing a printer driver relatively easy and painless. But a bug found in 2020, dubbed PrintDemon , showed that maybe they took that a bit too far back in the ’90s — and paid for it for decades. The core of the vulnerability lies in three facts: Non-administrative users can add printers to a Windows machine; the underlying mechanics make it possible to print to a file rather than a physical printing device; and crucial printing services on Windows run with system privileges. That means that, if you do it right, you can build a “printer” driver that can create a file (even an executable one) anywhere on the filesystem (even in privileged directories). There are plenty of exploits that have been cooked up to take advantage of these design flaws — Stuxnet , it turns out, was one of them — but PrintDemon was a real doozy, made possible because Microsoft’s fixes over the years had been patches rather than a complete rebuild of the printing subsystem. As Winsider described it , “With very subtle file system modifications, you can achieve file copy/write behavior that is not attributable to any process, especially after a reboot … with a carefully crafted port name, you can imagine simply having the Spooler drop a [portable executable] file anywhere on disk for you.” win32k.sys vulnerabilities Age: 23 years Date introduced: 1996 Date fixed: 2019 Two big vulnerabilities were detected in the Win32 API in Microsoft Windows in 2019. The first, found in April, was a Use-After-Free vulnerability , in which OS coding errors made it possible for programs to access system memory that should’ve been protected; this vulnerability was detected by security researchers when they discovered malicious hackers attempting to use it in the wild to gain control of computers. The other, discovered in December, was an elevation-of-privilege vulnerability lurking in the OS’s window switching functionality; this vulnerability was similarly discovered in the course of active attacks , which simulated keystrokes to create memory leaks. Both vulnerabilities have their origins in the early days of Windows. “The problem originates from the time when WIN32K made its debut with Windows NT 4.0, when much of Win32’s graphics engine was moved from user level to kernel to boost performance,” explained Boris Larin, senior security researcher at Kaspersky, back in 2019. And while these two vulnerabilities have been patched, that long-ago decision on the part of Microsoft has had much broader effects — and probably will continue to do so, Larin said then. “Throughout the years, the WIN32K component has been responsible for more than a half of all kernel security vulnerabilities discovered in Windows.” PuTTY heap overflow Age: 20 years, 9 months Date introduced: January 1999 Date fixed: October 2019 PuTTY is a free and open-source suite of tools that includes a serial console, a terminal emulator, and various network file transfer applications, with SSH and other encryption schemes built in. It was originally released to bring tools Unix admins took for granted to Windows and Mac OS, but has expanded its scope and is now in wide use on Unix systems as well . While PuTTY was designed to secure network connections, it turns out there was a vulnerability lurking at its heart. This was a heap overflow that could be triggered by an insufficiently long SSH key, which could result in crashing PuTTY or even remote code execution. The vulnerability was submitted to HackerOne as part of a bug bounty program, netting the submitter a $3,645 reward and a thank you from the PuTTY team, which noted that the bug had been present in the very earliest versions of the source code, dating back to 1999. PostgreSQL database vulnerabilities Age: 20+ years Date introduced: 2005 Date fixed: February 2026 An AI-powered security analysis tool was able to uncover a high-severity vulnerability in PostgreSQL , stemming from a flaw that dated back more than 20 years to early versions of the open-source relational database technologies. The AI tool — Xint Code — surfaced a critical remote code execution (RCE) vulnerability in PostgreSQL’s ‘pgcrypto’ extension , an encryption-based technology first contributed in 2005. Another team of security researchers discovered a critical validation vulnerability in the same PostgreSQL ‘pgcrypto’ extension. Both flaws were discovered during security vendor Wiz’s zeroday.cloud hacking event in late 2025, reported to developers and patched in February 2026. Developers of both PostgreSQL and MariaDB responded with the release of software updates to address all these security flaws. Nginx web server Age: 18 years Date introduced: 2008 Date fixed: May 2026 A critical and long latent vulnerability in the popular Nginx web server software was exposed by an AI-based security scanning tool. The CVE-2026-42945 vulnerability, a heap buffer overflow in NGINX’s URL rewrite module, was one of four flaws uncovered by security startup DepthFirst’s LLM-powered analysis platform. Developers at F5 warn exploitation can cause a crash, and in some conditions could enable arbitrary code execution, especially if Address Space Layout Randomization (ASLR) is disabled. System administrators are urged to update to patched versions of the software, 1.30.1 and 1.31.0, for the open-source version of Nginx. The commercial product, Nginx Plus, was also patched against the CVE-2026-42945 vulnerability and the three less severe flaws discovered by DepthFirst, as explained in a blog post . SIGRed DNS vulnerability Age: 17 years Date introduced: 2003 Date fixed: 2020 DNS is one of the underrated backbones of the internet, the system by which your computer knows what IP address correlates to any given URL . The system is hierarchical, with requests sent up and down the pyramid looking for DNS servers that know the answer to the question, “Where is this computer?” As a result, DNS has been built into all major operating systems. In 2020, Microsoft disclosed a critical vulnerability in its own version of DNS , which had been lurking in the code for 17 years. The vulnerability, dubbed SIGRed by its discoverers at Check Point , was a buffer overflow flaw in Windows DNS servers that could be triggered by exploit code tucked into a DNS packet’s signature. A malicious nameserver could send such packets in response to requests, bypassing most security protections and potentially gaining remote access to the Microsoft DNS server. The attack would be potentially wormable, meaning that it could be automated and spread without user intervention. Linux kernel-based virtualization module Januscape vulnerability Age: 16 years Date introduced: 2010 Date fixed: June 2026 A long dormant vulnerability in a Linux kernel-based virtualization module (KVM) poses arbitrary code execution risk to multi-tenant cloud environments and virtualized enterprise servers. The critical vulnerability — dubbed Januscape — creates a means for potential mechanism for attackers to escape VMs and execute malware upon host systems. More specifically the CVE-2026-53359 vulnerability arises from a use-after-free memory bug in the shadow MMU emulation of KVM on x86 CPU architecture machines. As such the critical vulnerability circumvents the security boundary that cloud providers and enterprises rely on to isolate sensitive processes on servers. The flaw stems from software introduced into Linux kernel code in 2010 and is the first KVM guest-to-host escape vulnerability that works on both Intel and AMD CPUs, according to Hyunwoo Kim , the security researcher who discovered the flaw. Python tarfile vulnerability rises again Age: 15 years Date introduced: 2007 Date fixed: September 2022 Cybersecurity company Trellix discovered that CVE-2007-4559, a vulnerability affecting Python’s tarfile module first identified in 2007, continued to affect hundreds of thousands of repositories up until at least September 2022. “While investigating an unrelated vulnerability, Trellix Advanced Research Center stumbled across a vulnerability in Python’s tarfile module,” Kasimir Schulz, a vulnerability researcher for Trellix’s Threat Labs, wrote on the firm’s blog . “Initially we thought we had found a new zero-day vulnerability. As we dug into the issue, we realized this was in fact CVE-2007-4559.” According to NIST, CVE-2007-4559 is a directory traversal vulnerability in the extract and extractall functions in the tarfile module in Python that allows user-assisted remote attackers to overwrite arbitrary files via a “..” sequence in filenames in a TAR archive. Bad actors can create exploits with as few as six lines of code added to the tarfile module, which allows users to add a filter to parse and modify a file’s metadata before it is added to the tar archive, Schulz said. CVE-2007-4559 “is incredibly easy to exploit, requiring little to no knowledge about complicated security topics. Due to this fact and the prevalence of the vulnerability in the wild, Python’s tarfile module has become a massive supply chain issue threatening infrastructure around the world.” Trellix has found more than 300,000 repositories affected by the vulnerability. Trellix developed a scanning utility to identify the vulnerability and patched a number of open-source repositories. Linux SCSI subsystem bugs Age: 15 years Date introduced: 2006 Date fixed: March 2021 SCSI, a 1980s-era data transfer standard, is still in use in some contexts today, and Linux, always intended to be as flexible and universal as possible, still has an extensive SCSI subsystem for those systems that need it. These modules are available via automatic module loading, in which the OS grabs and installs the system code it needs when it needs it — helpful if you find yourself plugging a SCSI drive into your Linux machine and don’t want to hunt down the necessary supporting code. Cybersecurity consultancy Grimm posted an extensive breakdown of several bugs in this Linux SCSI code that they discovered in March 2021. One was a buffer overflow vulnerability that could allow a normal user to gain root privileges, and the others were errors where information from the kernel could be leaked to user space , and. All could be used to get privileged information or as part of a DoS attack on the affected machine. Grimm dates the bugs back to 2006 and dryly notes that they’re “an indication of a lack of security-conscious programming practices that was prevalent at the time this code was developed.” Domain Time II man-on-the-side attack Age: 14 years Date introduced: 2007 Date fixed: April 2021 If two computers on the same network can’t agree on the time, the results can range from annoying to disastrous . This longstanding problem was to be solved by Domain Time II , a closed-source application in use on Windows, Linux, and Solaris. But Domain Time II harbored for most of its existence a very serious vulnerability. At intervals or on conditions the user can set, the program sends UDP queries to an update server run by Greyware Automation Products, the software’s vendor. If the server replies with a URL, Domain Time II will run a program with admin privileges to download and install an update from that URL. The problem? If a malicious actor manages to reply to the query before Greyware’s server does, that attacker can send its own reply , prompting Domain Time II to download whatever malware the attacker wants installed. In a true man-in-the-middle attack , the attacker would be intercepting communications in both directions; in contrast, this man-on-the-side attack can’t stop replies to its target machine getting through and so has to send its own reply more quickly. In practice, this means the attacker would need to control a computer on the target’s local network to pull this off, but this attack represents a way an attacker could escalate their intrusion onto more valuable and secure machines within a local network. This vulnerability was spotted by the security firm Grimm, which noted that the flaw was present in versions of the software going back at least to 2007. Critical vulnerability in Redis in-memory store Age: 13 years Date introduced: 2012 Date fixed: October 2025 A vulnerability in Redis in-memory store posed a critical risk for servers hosting the database. The vulnerability, identified as CVE-2025-49844 or RediShell, stemmed from a use-after-free memory corruption bug that has existed in the Redis code base for around 13 years and posed a remote code execution risk. While the flaw required authentication to exploit, an estimated 60,000 internet exposed Redis instances were exposed to the internet without authentication enabled, leaving these systems open to attack. Wiz researchers discovered the flaw and used it in the Pwn2Own Berlin contest in May 2025, weeks before its public disclosure in October 2025. LionWiki local file inclusion Age: 11 years, 11 months Date introduced: November 2008 Date fixed: October 2020 LionWiki is a minimalist wiki engine, programmed in PHP. Unlike many popular wiki engines, LionWiki doesn’t use a database, and instead is entirely file-based. Because its goal is simplicity, this is a strength, but it also makes a significant vulnerability possible. In essence, the various files underlying a particular LionWiki instance are accessed by file and pathnames in the URL of the corresponding pages. This means that, with a correctly crafted URL, you could traverse the filesystem of the server hosting the LionWiki instance. There are URL-filtering provisions in place to block attempts to do this, but as Infosec Institute’s cyber range engineer June Werner discovered, they could be defeated fairly easily . One thing Werner noted is that the vulnerability persisted despite attempts to correct it. “Some mitigations were first put in place in July of 2009, and then more extensive mitigations were put in place in January of 2012,” she noted. “Despite these mitigations, the code was still vulnerable to the same type of attack. This vulnerability stayed in the code for another eight years until it was rediscovered, along with a way to bypass the mitigations, in October 2020.” After the bug was formally reported , it was patched by the developer. sudo host Age: 11 years, 10 months Date introduced: September 2013 Date fixed: July 2024 The sudo command is an important tool in any Unix admin’s toolkit, granting superpowered user privileges to those who have the permission to invoke it. To access these privileges, a user must be listed in a configuration file called sudoers. Because many organizations centrally administer many Unix hosts, sudoers can include a list of specific hosts where each user has sudo rights, so that these config files can be written once and then be pushed out to all the organization’s hosts. The problem is that, to get access to the sudoers file and see the hosts on which you or another user might have sudo powers, you need those sudo powers yourself. But a command-line flag intended to let users view host-specific privileges could be abused to trick sudo into treating the command as if it were running on a different host — potentially one where the user has elevated privileges. That could allow the user to run commands, including those that edit sudoers, even if they shouldn’t have that access on the local machine. This security flaw isn’t rated as too serious , but it did lurk undetected for nearly 12 years. (Another more serious flaw with the chroot option , revealed at the same time, is a mere baby at two years old.) HashiCorp Vault and CyberArk Conjur logic flaws Age: 10 years Date introduced: 2015 Date fixed: August 2025 Multiple flaws in components of HashiCorp Vault and CyberArk Conjur , two open-source credential management systems, left the door open to a variety of attacks, including authentication bypass and the theft or erasure of supposedly protected secrets. Both HashiCorp Vault and CyberArk Conjur are used for storing and controlling access to secrets such as API keys, database passwords, certificates, and encryption keys. Each technology is commonly used in DevSecOps pipelines. Researchers from Cyata discovered an array of issues, many of which had remained hidden in the codebase of widely used open-source secrets vaults for years. The vulnerabilities were discovered after manual code reviews that focused on logic flaws in components responsible for authentication and policy enforcement rather than memory corruption issues typically detected by automated tools. Findings from the research — which led to the discovery of a combined total of 14 vulnerabilities in the two secrets vaults — were revealed at Black Hat USA in August 2025. The most severe vulnerability in HashiCorp Vault ( CVE-2025-6000 ) created a mechanism for attackers to delete a critical file containing the keys needed to decrypt stored secrets, leaving data unreachable. All the vulnerabilities were addressed before the research was publicly disclosed. Linux GRUB2 Secure Boot hole Age: 10 years Date introduced: 2010 Date fixed: July 2020 When UEFI was introduced to replace BIOS, it was deemed the cutting edge of security , with features to fight attacks that operated on the level of the bootloading software that starts up an OS. Key to this is an interlocked chain of signed cryptographic certificates that verifies each bootloader program as legitimate, a mechanism known as Secure Boot. The root certificate for UEFI is signed by Microsoft, and Linux distributions put their own bootloaders, each with its own validated certificate, further down the chain. But GRUB2, a widely popular Linux bootloader with a UEFI-ready certificate, contains a buffer overflow vulnerability that can be exploited by malicious code inserted into in its configuration file. (While GRUB2 itself is signed, its configuration file, meant to be editable by local admins, is not.) This hole was spotted by Eclypsium , and while an attacker would need to have a degree of local control of the target machine to implement this attack, if they pulled it off successfully, they could ensure that they remain in control of that computer going forward each time it boots up, making it difficult to evict them from the system. Telnet Age: 10 years, 8 months Date introduced: May 2017 Date fixed: Jan 2026 Telnet is an early internet protocol and associated tools used for remotely logging into another machine via a text-based terminal session. Although superseded by the more secure and encrypted SSH technology since the mid-1990s, Telnet is still widely used by embedded systems, network hardware, and other legacy systems. An easily-exploited Telnet authentication bypass vulnerability (CVE-2026-24061), introduced in code changes release in May 2017, left devices running pre-patched versions of the software wide open to remote compromise, provided that its Telnet server was exposed to the internet.

    Affected vendors and products

    More on software

    Other advisories

    Other news entries

    Source: https://www.csoonline.com/article/570815/old-software-bugs-that-took-way-too-long-to-squash.html

    ID