CVE-2018-25254CWE-787

CVE-2018-25254

Critical · published April 4, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
59.7
In the wild
Unconfirmed
What it is

NICO-FTP 3.0.1.19 contains a structured exception handler buffer overflow vulnerability that allows remote attackers to execute arbitrary code by sending crafted FTP commands. Attackers can connect to the FTP service and send oversized data in response handlers to overwrite SEH pointers and redirect execution to injected shellcode.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00914 · 59.7th percentile
Weakness
CWE-787 · Out-of-bounds Write
Published
2026-04-04T18:16Z
Affected products (1)
ProductVersionsFixed in
nico-ftp_project/nico-ftp≤ 3.0.1.19—
References (3)
https://en.softonic.com/download/nico-ftp/windows/post-download · [email protected]https://www.exploit-db.com/exploits/45442 · [email protected]https://www.vulncheck.com/advisories/nico-ftp-buffer-overflow-seh · [email protected]
EPSS history
Timeline
  • 04 APR 13:51Z
    NICO-FTP 3.0.1.19 Buffer Overflow SEH
    cvelistv5