Loading story…
CERT Polska disclosed CVE-2026-18370, a heap-based buffer overflow in eradman entr affecting all versions through 5.8. The flaw is in the run_utility() function, which allocates a fixed-size heap buffer with malloc(ARG_MAX) and then advances the destination pointer using strlcpy()'s return value. When the buffer is filled exactly, the remaining length can underflow as an unsigned size_t, creating an out-of-bounds write condition that can corrupt memory, crash the process, and cause denial of service.
The issue matches CWE-122: Heap-based Buffer Overflow and can be triggered locally with command-line arguments whose combined length exactly fills the buffer, or by abusing entr's /_ substitution feature to expand a short token into a longer pathname at runtime. CERT Polska said the vulnerability was responsibly reported by Michał Majchrowicz and Marcin Wyczechowski of the AFINE Team, coordinated disclosure, and noted that the bug was fixed in commit 2467fe0.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
CERT Polska disclosed CVE-2026-18370, a heap-based buffer overflow in eradman entr affecting all versions through 5.8. The advisory says the flaw in run_utility() can be triggered locally to cause memory corruption, process abort, and denial of service, and notes it was fixed in commit 2467fe0.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two newly recorded CVEs describe **stack-based buffer overflow** flaws that can lead to arbitrary code execution in legacy software components. **CVE-2017-20228** affects **Flat Assembler 1.71.21**, where oversized assembly input exceeding **5895 bytes** can overwrite the instruction pointer and enable **return-oriented programming (ROP)** for shell command execution. The issue is classified as **`CWE-787`** and carries high impact to confidentiality, integrity, and availability. A second entry, **CVE-2018-25222**, affects **SC v7.16** and similarly allows code execution through oversized input, in this case beyond **1052 bytes**, resulting in instruction pointer overwrite and shellcode execution in the application context. The vulnerability is also classified as **`CWE-787`**, with CVSS scoring indicating low attack complexity and severe impact, and both CVEs include references to **Exploit-DB** and **VulnCheck advisories**, signaling the availability of public technical details for defenders to review.
Jun 29, 2026
A critical global buffer overflow vulnerability has been identified in the *zlib* untgz utility, specifically affecting version 1.3.1.2. The flaw resides in the `TGZfname()` function, where an unbounded `strcpy()` operation copies user-supplied archive names from command-line arguments into a fixed-size global buffer of 1,024 bytes without proper length validation. Security researchers demonstrated that supplying an archive name exceeding this limit can trigger an out-of-bounds write, leading to memory corruption, denial-of-service, or potentially arbitrary code execution, depending on system configuration and compiler settings. The vulnerability, tracked as `CVE-2026-22184` with a CVSS score of 9.3, is trivially exploitable via command-line input and does not require any archive parsing or validation to trigger. Successful exploitation was confirmed using AddressSanitizer, which detected a global buffer overflow when the utility was invoked with a 4,096-byte filename. The issue is classified under CWE-120 (Buffer Copy without Checking Size of Input) and poses significant risk to systems utilizing the affected version of the untgz utility for archive extraction or processing.
Jun 29, 2026
Two high-severity vulnerabilities, `CVE-2018-25265` and `CVE-2018-25268`, were documented for **LanSpy 2.0.1.159**, affecting the application's scan functionality and exposing users to local buffer overflow attacks. The flaws were classified as `CWE-787` and can let an attacker trigger memory corruption by supplying oversized input in the scan section or scan field, causing application crashes and creating a path to arbitrary code execution. The published details indicate that `CVE-2018-25265` can be exploited through structured exception handling (SEH), including egghunter-based shellcode discovery and controlled jumps, while `CVE-2018-25268` allows instruction pointer overwrite with a payload consisting of 688 bytes of padding followed by 4 bytes of attacker-controlled data. Both entries were assigned high-impact CVSS v3.1 and CVSS v4.0 severity metrics, and the records reference material from **LizardSystems**, **Exploit-DB**, and **VulnCheck**.
Jun 29, 2026