CVE-2016-20038

HIGH

yTree 1.94-1.1 Stack-Based Buffer Overflow

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2016-20038. PoCs published by Juan Sacco.

AI-analyzed exploit summary This exploit demonstrates a stack-based buffer overflow in yTree v1.94-1.1, leveraging a crafted input to overwrite the EIP and execute arbitrary shellcode. The PoC includes a shellcode payload for spawning a shell and is tested on Kali Linux 2.0 x86.

Description

yTree 1.94-1.1 contains a stack-based buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying an excessively long argument to the application. Attackers can craft a malicious command-line argument containing shellcode and a return address to overwrite the stack and execute code in the application context.

Exploits (1)

exploitdb WORKING POC
by Juan Sacco · pythondoslinux
https://www.exploit-db.com/exploits/39406

This exploit demonstrates a stack-based buffer overflow in yTree v1.94-1.1, leveraging a crafted input to overwrite the EIP and execute arbitrary shellcode. The PoC includes a shellcode payload for spawning a shell and is tested on Kali Linux 2.0 x86.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: yTree v1.94-1.1
No auth needed
Prerequisites: yTree installed on the target system · ability to execute the exploit locally
devstral-2 · analyzed Apr 08, 2026 Full analysis →

References (3)

Core 3
Core References
Exploit exploit
ExploitDB-39406
https://www.exploit-db.com/exploits/39406
Product product
Official Product Homepage
http://www.han.de/~werner/ytree.html
Third Party Advisory third-party-advisory
VulnCheck Advisory: yTree 1.94-1.1 Stack-Based Buffer Overflow
https://www.vulncheck.com/advisories/ytree-stack-based-buffer-overflow

Scores

CVSS v3 8.4
EPSS 0.0018
EPSS Percentile 7.5%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-787
Status published
Products (1)
werner/yTree 1.94-1.1
Published Mar 28, 2026
Tracked Since Mar 29, 2026