CVE-2018-25217
Published: 26 March 2026
Summary
CVE-2018-25217 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Rttsoftware Pdf Explorer. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 12.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2018-25217 is a structured exception handler (SEH) overflow vulnerability in PDF Explorer version 1.5.66.2. The issue allows local attackers to execute arbitrary code by overwriting SEH records with malicious data. It occurs when the Custom fields settings dialog processes malicious input in the Label field, enabling a crafted payload that leverages buffer overflow, NSEH jump, and ROP gadget chains.
The vulnerability has a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-787 (Out-of-bounds Write). Local attackers require no privileges and can exploit it with low complexity. Successful exploitation grants arbitrary code execution, resulting in high impacts to confidentiality, integrity, and availability on the affected system.
Advisories and references include the vendor site at rttsoftware.com, a proof-of-concept exploit at exploit-db.com/exploits/46016, a trial download at rttsoftware.com/files/PDFExplorerTrialSetup.zip, and a Vulncheck advisory at vulncheck.com/advisories/pdf-explorer-structured-exception-handler-local-code-execution detailing the SEH-based local code execution. No patches or specific mitigations are mentioned in the provided details.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2018-21692
Vulnerability details
PDF Explorer 1.5.66.2 contains a structured exception handler (SEH) overflow vulnerability that allows local attackers to execute arbitrary code by overwriting SEH records with malicious data. Attackers can craft a payload with buffer overflow, NSEH jump, and ROP gadget chains…
more
that execute when the Custom fields settings dialog processes the malicious input in the Label field.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local SEH buffer overflow enabling arbitrary code execution in a client application directly maps to Exploitation for Client Execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the SEH overflow vulnerability in PDF Explorer by monitoring for flaws like CVE-2018-25217 and applying patches or removing the software.
Implements memory safeguards like DEP, ASLR, and stack canaries to block arbitrary code execution from SEH record overwrites and ROP gadget chains.
Validates inputs to the Custom fields Label field to prevent buffer overflows that trigger the SEH overwrite vulnerability.