CVE-2018-25223
Published: 28 March 2026
Summary
CVE-2018-25223 is a critical-severity Out-of-bounds Write (CWE-787) vulnerability in Ftnapps Crashmail Ii. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 45.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2018-25223 is a stack-based buffer overflow vulnerability (CWE-787) affecting Crashmail 1.6, an application for handling FTN (FidoNet Technology Network) mail. The flaw occurs when the application processes malicious input, leading to a buffer overflow that can be exploited for arbitrary code execution. Published on 2026-03-28 with a CVSS v3.1 score of 9.8 (Critical), it enables network-accessible attacks with low complexity, no privileges or user interaction required.
Remote attackers can exploit this vulnerability by sending crafted payloads containing ROP (Return-Oriented Programming) chains to the Crashmail 1.6 application over the network. Successful exploitation achieves arbitrary code execution within the application's context, granting high confidentiality, integrity, and availability impacts. Failed exploitation attempts may result in denial of service by crashing the application.
Advisories and related resources, including exploit details, are available at references such as http://exploitpack.com, http://ftnapps.sourceforge.net/crashmail.html, https://www.exploit-db.com/exploits/44331, and https://www.vulncheck.com/advisories/crashmail-stack-based-buffer-overflow-remote-code-execution. No specific patches or mitigation steps are detailed in the provided information.
A public proof-of-concept exploit is hosted on Exploit-DB (exploit 44331), indicating potential for real-world exploitation against unpatched Crashmail 1.6 instances.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2018-21704
Vulnerability details
Crashmail 1.6 contains a stack-based buffer overflow vulnerability that allows remote attackers to execute arbitrary code by sending malicious input to the application. Attackers can craft payloads with ROP chains to achieve code execution in the application context, with failed…
more
attempts potentially causing denial of service.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2018-25223 is a remote buffer overflow in a network-facing application (Crashmail), enabling unauthenticated arbitrary code execution, directly mapping to exploitation of public-facing applications.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the CVE by requiring identification, reporting, and patching of the stack-based buffer overflow flaw in Crashmail 1.6.
Prevents exploitation by validating malicious network inputs that trigger the buffer overflow in Crashmail 1.6.
Mitigates ROP chain exploitation of the stack buffer overflow through memory protections like stack canaries, ASLR, and DEP.