CVE-2016-20049
JAD 1.5.8e-1kali1 Stack-Based Buffer Overflow Remote Code Execution
- State
- Published
- Severity
- 9.3 Critical
- Published
- Mar 28, 2026
- Updated
- Mar 30, 2026
- Reserved
- Mar 28, 2026
Description
JAD 1.5.8e-1kali1 and prior contains a stack-based buffer overflow vulnerability that allows attackers to execute arbitrary code by supplying oversized input that exceeds buffer boundaries. Attackers can craft malicious input strings exceeding 8150 bytes to overflow the stack, overwrite return addresses, and execute shellcode in the application context.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-787 Out-of-bounds Write
Affected Products
| Product | Versions |
|---|---|
JAD Java DecompilerVaraneckas |
|
References
- ExploitDB-42076exploit
- Official Product Homepageproduct
- VulnCheck Advisory: JAD 1.5.8e-1kali1 Stack-Based Buffer Overflow Remote Code Executionthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.