CVE-2018-18585

PoC —

CVSS 3.1

4.3 medium

EPSS

3%p87

Published

Oct 23, 2018 (Oct 23, 2018)

Modified

Jun 17, 2026

Description

chmd_read_headers in mspack/chmd.c in libmspack before 0.8alpha accepts a filename that has '\0' as its first or second character (such as the "/\0" name).

Vendors: kyzer debian redhat canonical suse starwindsoftware
Products: libmspack, debian linux, enterprise linux desktop, enterprise linux server, enterprise linux workstation, ubuntu linux, linux enterprise server, starwind virtual san
Weakness: CWE-476
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

NVD CVE.org GitHub PoCs EPSS (3.1%)

In the news0 stories

No ingested article mentions this CVE yet.