CVE-2018-25223CWE-787

CVE-2018-25223

Critical · published March 28, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
58.8
In the wild
Unconfirmed
What it is

Crashmail 1.6 contains a stack-based buffer overflow vulnerability that allows remote attackers to execute arbitrary code by sending malicious input to the application. Attackers can craft payloads with ROP chains to achieve code execution in the application context, with failed attempts potentially causing denial of service.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00884 · 58.8th percentile
Weakness
CWE-787 · Out-of-bounds Write
Published
2026-03-28T16:16Z
Affected products (1)
ProductVersionsFixed in
ftnapps/crashmail_ii≤ 1.6—
References (4)
http://exploitpack.com · [email protected]http://ftnapps.sourceforge.net/crashmail.html · [email protected]https://www.exploit-db.com/exploits/44331 · [email protected]https://www.vulncheck.com/advisories/crashmail-stack-based-buffer-overflow-remote-code-execution · [email protected]
EPSS history
Timeline
  • 28 MAR 11:58Z
    Crashmail 1.6 Stack-based Buffer Overflow Remote Code Execution
    cvelistv5