CVE-2018-25222
Published: 28 March 2026
Summary
CVE-2018-25222 is a high-severity Out-of-bounds Write (CWE-787) vulnerability. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 3.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2018-25222 is a stack-based buffer overflow vulnerability in SC v7.16. The flaw allows local attackers to execute arbitrary code by supplying oversized input that exceeds buffer boundaries. Specifically, attackers can craft malicious input strings exceeding 1052 bytes to overwrite the instruction pointer and execute shellcode within the application context. This issue is classified under CWE-787 (Out-of-bounds Write) with a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for complete system compromise from a local perspective.
The attack requires local access to the system, with low attack complexity, no privileges, and no user interaction. An attacker can exploit this by providing specially crafted input to the vulnerable component, leading to control flow hijacking and arbitrary code execution in the context of the SC application. Successful exploitation grants high confidentiality, integrity, and availability impacts, potentially allowing full compromise of the affected process.
Advisories and related resources, including an exploit published on Exploit-DB (https://www.exploit-db.com/exploits/44279) and a VulnCheck advisory (https://www.vulncheck.com/advisories/sc-stack-based-buffer-overflow-remote-code-execution), detail the vulnerability and proof-of-concept exploitation, highlighting the need for input validation and bounds checking in affected deployments. No specific patch information is detailed in the provided references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2018-21702
Vulnerability details
SC v7.16 contains a stack-based buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying oversized input that exceeds buffer boundaries. Attackers can craft malicious input strings exceeding 1052 bytes to overwrite the instruction pointer and execute…
more
shellcode in the application context.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local stack-based buffer overflow enabling arbitrary code execution with no privileges required directly maps to exploitation for privilege escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents stack-based buffer overflows by validating input length and content to reject oversized strings exceeding buffer boundaries.
Protects against arbitrary code execution from buffer overflows via memory safeguards like stack canaries, ASLR, and DEP that prevent instruction pointer overwrite.
Remediates the specific buffer overflow flaw through timely identification, reporting, and correction via patches or updates.