How severe is unbounded strcat buffer overflow?

Shield rates this high (CVSS 8.1), classified as CWE-120.

Rules / C/C++

SHIELD-CPP-002

Unbounded strcat buffer overflow

highC/C++CWE-120CVSS 8.1

strcat appends without checking remaining destination capacity.

Use strncat or strlcat with the remaining buffer size accounted for.

Vulnerable — Shield flags thisappend.c

#include <string.h>

void build_greeting(char *msg, const char *name) {
    strcat(msg, name);
}

Fixed — scans cleanappend.c

#include <string.h>

void build_greeting(char msg[64], const char *name) {
    strncat(msg, name, 64 - strlen(msg) - 1);
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-CPP-002, the fixed one does not.