CVE-2018-25432

Arm Whois 3.11 contains a buffer overflow vulnerability that allows local attackers to execute arbitrary code by overwriting the structured exception handler. Attackers can craft a malicious input file with a 672-byte offset to overwrite the nSEH and SEH pointers, enabling code execution through exception handler hijacking.

CVSS v3 8.4 HIGH

8.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.5 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
http://www.armcode.com
http://www.armcode.com/downloads/arm-whois.exe
https://www.exploit-db.com/exploits/45907
https://www.vulncheck.com/advisories/arm-whois-buffer-overflow-via-aslr-bypass

Configurations

No configuration.

History

22 Jul 2026, 08:10

Type	Values Removed	Values Added
Summary		(es) Arm Whois 3.11 contiene una vulnerabilidad de desbordamiento de búfer que permite a atacantes locales ejecutar código arbitrario sobrescribiendo el gestor de excepciones estructuradas. Los atacantes pueden crear un archivo de entrada malicioso con un desplazamiento de 672 bytes para sobrescribir los punteros nSEH y SEH, lo que permite la ejecución de código mediante el secuestro del gestor de excepciones.

01 Jun 2026, 22:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-01 22:16

Updated : 2026-07-22 08:10

NVD link : CVE-2018-25432

Mitre link : CVE-2018-25432

CVE.ORG link : CVE-2018-25432

JSON object : View

Products Affected

No product.

CWE

CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

{"id": "CVE-2018-25432", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2018-25432", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-02T12:33:09.013812Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.5}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.6, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "Armcode", "product": "Arm Whois", "versions": [{"status": "affected", "version": "3.11"}]}]}], "published": "2026-06-01T22:16:16.583", "references": [{"url": "http://www.armcode.com", "source": "disclosure@vulncheck.com"}, {"url": "http://www.armcode.com/downloads/arm-whois.exe", "source": "disclosure@vulncheck.com"}, {"url": "https://www.exploit-db.com/exploits/45907", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/arm-whois-buffer-overflow-via-aslr-bypass", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-120"}]}], "descriptions": [{"lang": "en", "value": "Arm Whois 3.11 contains a buffer overflow vulnerability that allows local attackers to execute arbitrary code by overwriting the structured exception handler. Attackers can craft a malicious input file with a 672-byte offset to overwrite the nSEH and SEH pointers, enabling code execution through exception handler hijacking."}, {"lang": "es", "value": "Arm Whois 3.11 contiene una vulnerabilidad de desbordamiento de b\u00fafer que permite a atacantes locales ejecutar c\u00f3digo arbitrario sobrescribiendo el gestor de excepciones estructuradas. Los atacantes pueden crear un archivo de entrada malicioso con un desplazamiento de 672 bytes para sobrescribir los punteros nSEH y SEH, lo que permite la ejecuci\u00f3n de c\u00f3digo mediante el secuestro del gestor de excepciones."}], "lastModified": "2026-07-22T08:10:00.117", "sourceIdentifier": "disclosure@vulncheck.com"}