← back
CVE-2018-25267

UltraISO 9.7.1.3519 Buffer Overflow via Output FileName

CVSS 6.9 MEDIUMEPSS 0.2%CWE-787
UltraISO 9.7.1.3519 contains a local buffer overflow vulnerability in the Output FileName field of the Make CD/DVD Image dialog that allows attackers to overwrite SEH and SE handler records. Attackers can craft a malicious filename string with 304 bytes of data followed by SEH record overwrite values and paste it into the Output FileName field to trigger a denial of service crash.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
Ultraiso · UltraISO
public PoCs found — 1
cve_referencewww.exploit-db.com/exploits/45996unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
https://www.exploit-db.com/exploits/45996https://www.ultraiso.com/https://www.vulncheck.com/advisories/ultraiso-buffer-overflow-via-output-filename