Title: stack-overflow error from the HPSPLIT procedure could be exploited by a crafted attack

Severity: Medium

Description: In SAS/STAT® software, if you are using the HPSPLIT procedure and a stack-overflow error occurs, then you might encounter a security vulnerability.  Stack-overflow errors display text like the following:

Stack-overflow errors can occur when both of these conditions are true.

• You are using the CLASS/MODEL syntax in your HPSPLIT code.
• At least one of the variables in the model has a formatted length that exceeds 32.

To avoid the problem, take either of these actions.

• Use the INPUT/TARGET syntax instead of the CLASS/MODEL syntax. The INPUT/TARGET syntax normalizes variable levels such that the overflow cannot occur.
• Use formatted data lengths that do not exceed 32.

Potential Impact: stack-overflow from the HPSPLIT procedure could be exploited by a crafted attack

Click the Hot Fix tab in this note to access the hot fix for this issue.

Operating System and Release Information

A fix for this issue for Base SAS Statistical threaded kernel extensions 15.1 is available at:

A fix for this issue for SAS Threaded Kernel Extensions for High-Performance Statistics 15.1 is available at: