CVE-2018-25255

10-Strike LANState 8.8 contains a local buffer overflow vulnerability in structured exception handling that allows local attackers to execute arbitrary code by crafting malicious LSM map files. Attackers can create a specially formatted LSM file with a payload in the ObjCaption parameter that overflows the buffer, overwrites the SEH chain, and executes shellcode when the file is opened in the application.

CVSS v3 8.4 HIGH

8.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.5 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.10-strike.com/lanstate/download.shtml
https://www.10-strike.com/products.shtml
https://www.exploit-db.com/exploits/45086
https://www.vulncheck.com/advisories/10-strike-lanstate-local-buffer-overflow-seh

Configurations

No configuration.

History

20 Jul 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) 10-Strike LANState 8.8 contiene una vulnerabilidad local de desbordamiento de búfer en el manejo estructurado de excepciones que permite a atacantes locales ejecutar código arbitrario mediante la creación de archivos de mapa LSM maliciosos. Los atacantes pueden crear un archivo LSM con formato especial con una carga útil en el parámetro ObjCaption que desborda el búfer, sobrescribe la cadena SEH y ejecuta shellcode cuando el archivo se abre en la aplicación.

04 Apr 2026, 14:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-04-04 14:16

Updated : 2026-07-20 20:10

NVD link : CVE-2018-25255

Mitre link : CVE-2018-25255

CVE.ORG link : CVE-2018-25255

JSON object : View

Products Affected

No product.

CWE

CWE-787

Out-of-bounds Write

{"id": "CVE-2018-25255", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2018-25255", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-06T13:26:26.613283Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.5}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.6, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "10-Strike", "product": "Strike LANState", "versions": [{"status": "affected", "version": "8.8"}]}]}], "published": "2026-04-04T14:16:21.907", "references": [{"url": "https://www.10-strike.com/lanstate/download.shtml", "source": "disclosure@vulncheck.com"}, {"url": "https://www.10-strike.com/products.shtml", "source": "disclosure@vulncheck.com"}, {"url": "https://www.exploit-db.com/exploits/45086", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/10-strike-lanstate-local-buffer-overflow-seh", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "10-Strike LANState 8.8 contains a local buffer overflow vulnerability in structured exception handling that allows local attackers to execute arbitrary code by crafting malicious LSM map files. Attackers can create a specially formatted LSM file with a payload in the ObjCaption parameter that overflows the buffer, overwrites the SEH chain, and executes shellcode when the file is opened in the application."}, {"lang": "es", "value": "10-Strike LANState 8.8 contiene una vulnerabilidad local de desbordamiento de b\u00fafer en el manejo estructurado de excepciones que permite a atacantes locales ejecutar c\u00f3digo arbitrario mediante la creaci\u00f3n de archivos de mapa LSM maliciosos. Los atacantes pueden crear un archivo LSM con formato especial con una carga \u00fatil en el par\u00e1metro ObjCaption que desborda el b\u00fafer, sobrescribe la cadena SEH y ejecuta shellcode cuando el archivo se abre en la aplicaci\u00f3n."}], "lastModified": "2026-07-20T20:10:00.110", "sourceIdentifier": "disclosure@vulncheck.com"}