CVE-2016-4289

The CVE-2016-4289 issue is confirmed in GMER where data from SysTreeView32 is handled with a TVITEM buffer that is too small for Unicode paths. The root cause is a 200-character ANSI-sized buffer (cchTextMax = 0xC8) used when the code ultimately calls SendMessageA with TVM_GETITEMW, which treats ...