{"id":"CVE-2018-25154","state":"PUBLISHED","title":"GNU Barcode 0.99 Buffer Overflow in Code 93 Encoding Mechanism","description":"GNU Barcode 0.99 contains a buffer overflow vulnerability in its code 93 encoding process that allows attackers to trigger memory corruption. Attackers can exploit boundary errors during input file processing to potentially execute arbitrary code on the affected system.","publishedAt":"2025-12-24T19:27:53.486Z","updatedAt":"2026-04-07T14:03:49.009Z","severity":{"score":8.5,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["The GNU Project | Free Software Foundation, Inc. GNU Barcode"],"affected":[{"vendor":"The GNU Project | Free Software Foundation, Inc.","product":"GNU Barcode","versions":[{"version":"0.99","status":"affected"}]}],"references":["https://www.exploit-db.com/exploits/44797","https://www.gnu.org/software/barcode/","https://directory.fsf.org/wiki/Barcode"],"weaknesses":["CWE-787"],"ingestedAt":"2026-10-29T19:44:44.295Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2018/25xxx/CVE-2018-25154.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2018-25154","state":"PUBLISHED","datePublished":"2025-12-24T19:27:53.486Z","dateUpdated":"2026-04-07T14:03:49.009Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2025-12-24T14:28:02.436Z"},"containers":{"cna":{"title":"GNU Barcode 0.99 Buffer Overflow in Code 93 Encoding Mechanism","descriptions":[{"lang":"en","value":"GNU Barcode 0.99 contains a buffer overflow vulnerability in its code 93 encoding process that allows attackers to trigger memory corruption. Attackers can exploit boundary errors during input file processing to potentially execute arbitrary code on the affected system."}],"affected":[{"vendor":"The GNU Project | Free Software Foundation, Inc.","product":"GNU Barcode","versions":[{"version":"0.99","status":"affected"}]}],"references":[{"url":"https://www.exploit-db.com/exploits/44797","name":"ExploitDB-44797","tags":["exploit"]},{"url":"https://www.gnu.org/software/barcode/","name":"GNU Barcode Official Product Page","tags":["product"]},{"url":"https://directory.fsf.org/wiki/Barcode","name":"FSF Directory Entry for Barcode","tags":["product"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","baseScore":8.5,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS"},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-787","lang":"en","description":"Out-of-bounds Write","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-04-07T14:03:49.009Z"},"credits":[{"lang":"en","value":"LiquidWorm as Gjoko Krstic of Zero Science Lab","type":"finder"}],"x_generator":{"engine":"vulncheck"},"datePublic":"2018-05-29T00:00:00.000Z"},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-12-24T20:07:11.556089Z","id":"CVE-2018-25154","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-12-24T20:24:32.336Z"}}]}}}