Severity: High

Description: Under certain conditions, an error might occur that results in a segmentation violation or buffer overflow in Base SAS or SAS/STAT. Although the issue is more common on these products, it might occur on other SAS products. 

Potential Impact: This vulnerability could lead to a denial of service or arbitrary code execution. 

Click the Hot Fix tab in this note to access the hot fix for this issue. 

Operating System and Release Information

Viya on Linux: An update for this issue is available for SAS Viya 3.5. For instructions on how to access and apply software updates, see the Updating Your SAS Viya software section in the SAS Viya 3.5 for Linux Deployment Guide at

A fix for this issue for Base SAS 9.4_M8 is available at:

A fix for this issue for Base SAS User Interface 9.4_M8 is available at:

A fix for this issue for SAS/STAT 15.3 is available at:

A fix for this issue for SAS/GRAPH 9.4_M8 is available at:

A fix for this issue for SAS/ACCESS Interface to PC Files 9.4_M8 is available at:

A fix for this issue for SAS ODS Graphics C Renderer 9.47 is available at:

A fix for this issue for Base SAS 9.4_M7 is available at:

A fix for this issue for SAS/GRAPH 9.4_M7 is available at: