--- title: 17 old software bugs that took way too long to squash description: A curated list of 17 notable software vulnerabilities that remained undetected for over a decade, ranging from a 30-year-old libpng heap buffer overflow... canonical: https://daily.dev/posts/17-old-software-bugs-that-took-way-too-long-to-squash-0odlmy6fz twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: 17 old software bugs that took way too long to squash | daily.dev og:description: A curated list of 17 notable software vulnerabilities that remained undetected for over a decade, ranging from a 30-year-old libpng heap buffer overflow... og:url: https://daily.dev/posts/17-old-software-bugs-that-took-way-too-long-to-squash-0odlmy6fz og:image: https://api.daily.dev/og/posts/0oDlMY6fz.png og:image:alt: 17 old software bugs that took way too long to squash og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # 17 old software bugs that took way too long to squash **[CSO Online](https://daily.dev/sources/csoonline)** · 18 min read · 5 upvotes · 0 comments ## Summary A curated list of 17 notable software vulnerabilities that remained undetected for over a decade, ranging from a 30-year-old libpng heap buffer overflow (CVE-2026-25646) to a 10-year-old Telnet authentication bypass. The list spans widely used systems including PostgreSQL, Nginx, Redis, Linux KVM, PuTTY, Windows DNS (SIGRed), Python's tarfile module, sudo, HashiCorp Vault, and GRUB2. Several recent discoveries were accelerated by AI-powered security analysis tools like Xint Code and DepthFirst's LLM platform, which can scan and chain exploit reasoning at machine speed. The oldest unpatched flaw highlighted is a 30-year-old libpng vulnerability fixed in February 2026, while the longest-dormant entry is a 24-year-old Windows printing subsystem bug (PrintDemon) fixed in 2020. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What CVE was found in PostgreSQL's pgcrypto extension and how old was the flaw? An AI-powered security tool called Xint Code surfaced a critical remote code execution vulnerability in PostgreSQL's pgcrypto extension, a flaw dating back to the extension's contribution in 2005. A separate research team found a critical validation vulnerability in the same extension. Both were discovered during Wiz's zeroday.cloud hacking event in late 2025 and patched in February 2026. _Teams tracking database CVEs like this can follow patch timelines for PostgreSQL on daily.dev._ ### What is the RediShell vulnerability in Redis and how severe is it? RediShell, tracked as CVE-2025-49844, is a use-after-free memory corruption bug in Redis that had existed in the codebase for roughly 13 years and enables remote code execution. Although exploitation requires authentication, around 60,000 Redis instances were found exposed to the internet without authentication enabled. Wiz researchers discovered it and demoed it at Pwn2Own Berlin in May 2025 before public disclosure in October 2025. _Anyone auditing exposed Redis instances can keep up with disclosures like RediShell via daily.dev._ ### What does the sudo host CVE-2025-32462 vulnerability allow an attacker to do? CVE-2025-32462 lets a user abuse a command-line flag meant to display host-specific sudo privileges to trick sudo into treating a command as if it ran on a different host, potentially one where they have elevated rights. This can let an unprivileged user run commands, including editing the sudoers file, on a machine where they should not have that access. The flaw went undetected for nearly 12 years after being introduced in September 2013 and was fixed in July 2024. _Linux admins hardening sudo configs can track flaws like this one on daily.dev._ ## Similar posts on daily.dev - [Researchers unearth 30-year-old vulnerability in libpng library](https://daily.dev/posts/researchers-unearth-30-year-old-vulnerability-in-libpng-library-47vswqthb) · CSO Online · 0 upvotes · 0 comments - [20% of Linux Kernel Bugs Hide for More Than 5 Years](https://daily.dev/posts/20-of-linux-kernel-bugs-hide-for-more-than-5-years-tbqkb6zyc) · It's Foss · 0 upvotes · 0 comments - [This Week In Security: Getting Back Up To Speed](https://daily.dev/posts/this-week-in-security-getting-back-up-to-speed-wbbgutihg) · Hackaday · 0 upvotes · 0 comments - [Did AI Just Break Software Security For Ever?](https://daily.dev/posts/did-ai-just-break-software-security-for-ever--6pxwdikky) · Foojay.io · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#linux](https://daily.dev/tags/linux), [#windows](https://daily.dev/tags/windows), [#vulnerability](https://daily.dev/tags/vulnerability) [View this post on daily.dev](https://daily.dev/posts/17-old-software-bugs-that-took-way-too-long-to-squash-0odlmy6fz) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"17 old software bugs that took way too long to squash","url":"https://daily.dev/posts/17-old-software-bugs-that-took-way-too-long-to-squash-0odlmy6fz","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/17-old-software-bugs-that-took-way-too-long-to-squash-0odlmy6fz"},"datePublished":"2026-08-12T07:33:53.751Z","dateModified":"2026-09-14T08:36:04.149Z","description":"A curated list of 17 notable software vulnerabilities that remained undetected for over a decade, ranging from a 30-year-old libpng heap buffer overflow...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/356115298a0ffcd5313b58f013f045f5?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/356115298a0ffcd5313b58f013f045f5?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"CSO Online","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"CSO Online","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/98667e4b5cac46cf9c470819c6cf71cd","url":"https://daily.dev/sources/csoonline"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/17-old-software-bugs-that-took-way-too-long-to-squash-0odlmy6fz","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":5},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,linux,windows,vulnerability","timeRequired":"PT18M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"CSO Online","item":"https://daily.dev/sources/csoonline"},{"@type":"ListItem","position":3,"name":"17 old software bugs that took way too long to squash"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/17-old-software-bugs-that-took-way-too-long-to-squash-0odlmy6fz#faq","mainEntity":[{"@type":"Question","name":"What CVE was found in PostgreSQL's pgcrypto extension and how old was the flaw?","acceptedAnswer":{"@type":"Answer","text":"An AI-powered security tool called Xint Code surfaced a critical remote code execution vulnerability in PostgreSQL's pgcrypto extension, a flaw dating back to the extension's contribution in 2005. A separate research team found a critical validation vulnerability in the same extension. Both were discovered during Wiz's zeroday.cloud hacking event in late 2025 and patched in February 2026. Teams tracking database CVEs like this can follow patch timelines for PostgreSQL on daily.dev."}},{"@type":"Question","name":"What is the RediShell vulnerability in Redis and how severe is it?","acceptedAnswer":{"@type":"Answer","text":"RediShell, tracked as CVE-2025-49844, is a use-after-free memory corruption bug in Redis that had existed in the codebase for roughly 13 years and enables remote code execution. Although exploitation requires authentication, around 60,000 Redis instances were found exposed to the internet without authentication enabled. Wiz researchers discovered it and demoed it at Pwn2Own Berlin in May 2025 before public disclosure in October 2025. Anyone auditing exposed Redis instances can keep up with disclosures like RediShell via daily.dev."}},{"@type":"Question","name":"What does the sudo host CVE-2025-32462 vulnerability allow an attacker to do?","acceptedAnswer":{"@type":"Answer","text":"CVE-2025-32462 lets a user abuse a command-line flag meant to display host-specific sudo privileges to trick sudo into treating a command as if it ran on a different host, potentially one where they have elevated rights. This can let an unprivileged user run commands, including editing the sudoers file, on a machine where they should not have that access. The flaw went undetected for nearly 12 years after being introduced in September 2013 and was fixed in July 2024. Linux admins hardening sudo configs can track flaws like this one on daily.dev."}}]} ```