cfgtildeexpand in confuse.c in libConfuse 3.3 has a heap-based buffer over-read.
{ "urgency": "not yet assigned" }