CVE-2018-25220
CVE-2018-25220 · Bochs 2.6-5 Buffer Overflow Remote Code Execution
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Bochs 2.6-5 contains a stack-based buffer overflow vulnerability that allows attackers to execute arbitrary code by supplying an oversized input string to the application. Attackers can craft a malicious payload with 1200 bytes of padding followed by a return-oriented programming chain to overwrite the instruction pointer and execute shell commands with application privileges.
CVSS 9.3 · Critical · EPSS 0.6%
- Published
- Updated
Stack: system
Affected products and versions
bochs
- Versions
- 2.6-5: Affected
No fix published
bochs Ubuntu:16.04:LTS
- Versions
- 2.6-2build1
- 2.6-5
- 2.6-5build1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
bochs Ubuntu:18.04:LTS
- Versions
- 2.6-5build1
- 2.6-5build2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
bochs Ubuntu:20.04:LTS
- Versions
- 2.6.9+dfsg-3build1
- 2.6.9+dfsg-4
- 2.6.9+dfsg-5
- 2.6.10+dfsg-2
- 2.6.11+dfsg-1
- 2.6.11+dfsg-1build1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
bochs Ubuntu:22.04:LTS
- Versions
- 2.6.11+dfsg-4
- 2.7+dfsg-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
bochs Ubuntu:24.04:LTS
- Versions
- 2.7+dfsg-4build1
- 2.7+dfsg-4build4
- 2.7+dfsg-4build5
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
bochs Ubuntu:25.10
- Versions
- 2.8+dfsg-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
bochs Ubuntu:26.10
- Versions
- 2.8+dfsg-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
bochs Ubuntu:26.04:LTS
- Versions
- 2.8+dfsg-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published