CVE-2017-20227
JAD 1.5.8e-1kali1 Stack-Based Buffer Overflow
- State
- Published
- Severity
- 9.3 Critical
- Published
- Mar 28, 2026
- Updated
- Apr 1, 2026
- Reserved
- Mar 28, 2026
Description
JAD Java Decompiler 1.5.8e-1kali1 and prior contains a stack-based buffer overflow vulnerability that allows attackers to execute arbitrary code by supplying overly long input that exceeds buffer boundaries. Attackers can craft malicious input passed to the jad command to overflow the stack and execute a return-oriented programming chain that spawns a shell.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-787 Out-of-bounds Write
Affected Products
| Product | Versions |
|---|---|
JAD Java DecompilerVaraneckas |
|
References
- ExploitDB-42255exploit
- Official Product Homepageproduct
- VulnCheck Advisory: JAD 1.5.8e-1kali1 Stack-Based Buffer Overflowthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.