CVE-2018-25303
Published: 29 April 2026
Summary
CVE-2018-25303 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Alloksoft (inferred from references). Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 5.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
Allok Video to DVD Burner version 2.6.1217 is affected by CVE-2018-25303, a stack-based buffer overflow vulnerability in the License Name field. This flaw allows local attackers to trigger a structured exception handler (SEH) overwrite, enabling arbitrary code execution. The vulnerability is classified under CWE-121 (Stack-based Buffer Overflow) with a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Local attackers with access to the system can exploit this vulnerability by crafting a malicious input string consisting of 780 bytes of junk data, followed by SEH chain pointers and shellcode. By pasting this string into the License Name field during the registration process, attackers can overwrite the SEH and achieve arbitrary code execution with high confidentiality, integrity, and availability impact, without requiring privileges or significant user interaction beyond local access.
References include the vendor site at http://www.alloksoft.com/, an exploit proof-of-concept at https://www.exploit-db.com/exploits/44518, and an advisory from VulnCheck at https://www.vulncheck.com/advisories/allok-video-to-dvd-burner-buffer-overflow-seh. No specific patch or mitigation details are detailed in the provided information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2018-21824
Vulnerability details
Allok Video to DVD Burner 2.6.1217 contains a stack-based buffer overflow vulnerability in the License Name field that allows local attackers to execute arbitrary code by triggering a structured exception handler (SEH) overwrite. Attackers can craft a malicious input string…
more
with 780 bytes of junk data followed by SEH chain pointers and shellcode, then paste it into the License Name field during registration to achieve code execution.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local stack-based buffer overflow with SEH overwrite directly enables arbitrary code execution (T1203) and can be leveraged for privilege escalation depending on process context (T1068).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires identification, reporting, and correction of the stack-based buffer overflow flaw in the License Name field to eliminate the vulnerability.
Mandates validation of inputs to the License Name field to block oversized or malformed strings that trigger the buffer overflow.
Implements memory protections such as stack canaries or DEP to prevent SEH overwrite and arbitrary code execution from the buffer overflow.