CVE-2018-25427
Arm Whois 3.11 Buffer Overflow via SEH Overwrite
- State
- Published
- Severity
- 9.3 Critical
- Published
- Jun 1, 2026
- Updated
- Jun 2, 2026
- Reserved
- May 31, 2026
Description
Arm Whois 3.11 contains a stack-based buffer overflow vulnerability that allows remote attackers to execute arbitrary code by supplying oversized input to the IP address or domain field. Attackers can craft malicious input exceeding 658 bytes with shellcode to overwrite the structured exception handler and gain command execution when the application processes the input.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-121 Stack-based Buffer Overflow
Affected Products
| Product | Versions |
|---|---|
Arm WhoisArmcode |
|
References
- ExploitDB-45796exploit
- Official Product Homepageproduct
- Product Referenceproduct
- VulnCheck Advisory: Arm Whois 3.11 Buffer Overflow via SEH Overwritethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.