Vulnerability record · CVE-2017-14586 · published 27 November 2017

CVE-2017-14586: Atlassian hipchat memory buffer overflow vulnerability

Atlassian · Hipchat

The Hipchat for Mac desktop client is vulnerable to client-side remote code execution via video call link parsing. Hipchat for Mac desktop clients at or above version 4.0 and before version 4.30 are affected by this vulnerability.

9.8 CVSS 3.1 Critical EPSS 3.5% · top 11.2% CWE-119 · Memory buffer overflow

9.8CVSS 3.1 base score, v2 7.5

3.5%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

6References

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Hipchat Atlassian

References

Link	Tags
http://www.securityfocus.com/bid/101947	Third Party AdvisoryVDB Entry
https://confluence.atlassian.com/hc/hipchat-server-security-advisory-2017-11-22-939946293.html	Vendor Advisory
https://jira.atlassian.com/browse/HCPUB-3473	Issue TrackingVendor Advisory
http://www.securityfocus.com/bid/101947	Third Party AdvisoryVDB Entry
https://confluence.atlassian.com/hc/hipchat-server-security-advisory-2017-11-22-939946293.html	Vendor Advisory
https://jira.atlassian.com/browse/HCPUB-3473	Issue TrackingVendor Advisory

Track CVE-2017-14586 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2018-1000418Atlassian hipchat incorrect authorization vulnerabilityAn improper authorization vulnerability exists in Jenkins HipChat Plugin 2.2.0 and earlier in HipChatNotifier.java that allows attackers with Overall…EPSS 1.1%9 Jan 2019 6.5CVE-2018-1000419Atlassian hipchat vulnerabilityAn improper authorization vulnerability exists in Jenkins HipChat Plugin 2.2.0 and earlier in HipChatNotifier.java that allows attackers with Overall…EPSS 1.6%9 Jan 2019 6.5CVE-2015-5603HipChat for JIRA plugin Velocity template injection enables Java code executionThe HipChat for JIRA plugin before 6.30.0 fails to properly handle Velocity template input, allowing remote authenticated users to inject template di…EPSS 59%analysed21 Sep 2015 5.9CVE-2017-8058Atlassian hipchat improper certificate validation vulnerabilityAcceptance of invalid/self-signed TLS certificates in Atlassian HipChat before 3.16.2 for iOS allows a man-in-the-middle and/or physically proximate …EPSS 0.58%5 May 2017 9.5CVE-2026-88772Citrix netscaler application delivery controller memory buffer overflow vulnerabilityVulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 F…KEVEPSS 1.2%27 Sep 2026 8.8CVE-2026-8452Citrix NetScaler ADC and Gateway memory buffer overflow causes DoSCVE-2026-8452 is a memory buffer overflow (CWE-119) in Citrix NetScaler ADC and NetScaler Gateway that leads to unpredictable or erroneous behavior a…KEVEPSS 1.0%analysed30 Jun 2026 8.8CVE-2009-3459Adobe Reader and Acrobat heap buffer overflow via crafted PDFAdobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 contain a heap-based buffer overflow (CWE-122) triggered by a crafted…KEVEPSS 87%analysed13 Oct 2009 9.8CVE-2008-4250Microsoft Windows Server service RPC path canonicalization buffer overflowThe Server service in multiple Windows versions fails to properly handle path canonicalization, allowing a crafted RPC request to overflow a buffer a…KEVEPSS 99%analysed23 Oct 2008

Source: NIST National Vulnerability Database (record CVE-2017-14586), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.