CVE-2018-25223
Crashmail 1.6 Stack-based Buffer Overflow Remote Code Execution
- State
- Published
- Severity
- 9.3 Critical
- Published
- Mar 28, 2026
- Updated
- Oct 1, 2026
- Reserved
- Mar 28, 2026
Description
Crashmail 1.6 contains a stack-based buffer overflow vulnerability that allows remote attackers to execute arbitrary code by sending malicious input to the application. Attackers can craft payloads with ROP chains to achieve code execution in the application context, with failed attempts potentially causing denial of service.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-787 Out-of-bounds Write
Affected Products
| Product | Versions |
|---|---|
Crashmailcrashmail |
|
References
- ExploitDB-44331exploit
- Official Product Homepageproduct
- Official Product Homepageproduct
- VulnCheck Advisory: Crashmail 1.6 Stack-based Buffer Overflow Remote Code Executionthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.