CVE-2020-36619: 
NixOS vulnerability analysis and mitigation

A critical format string vulnerability was discovered in multimon-ng affecting the addch function in the file demodflex.c. The vulnerability was assigned CVE-2020-36619 and was disclosed in December 2022. The issue occurs when manipulating the argument ch, which could lead to format string exploitation (CVE Details, NVD).

The vulnerability exists in the addch function within demodflex.c where uncontrolled format string input could be passed through to unixinput.c::_verbprintf. This introduces both a format string vulnerability and potential stack corruption risks. The issue specifically occurs when handling the '%' character in the input stream (GitHub Commit).

The format string vulnerability could potentially lead to stack corruption and code execution, making this a critical security issue. The vulnerability could allow attackers to exploit the format string handling to manipulate program execution (NVD).

The vulnerability was fixed in version 1.2.0 of multimon-ng through patch e5a51c508ef952e81a6da25b43034dd1ed023c07. The fix involves proper handling of the '%' character by escaping it appropriately. Users are recommended to upgrade to version 1.2.0 or later to address this security issue (GitHub Release).