CVE-2018-11438

HIGH

libmobi 0.3 - Remote Code Execution via Crafted MOBI File

Title source: llm

Description

The mobi_decompress_lz77 function in compression.c in Libmobi 0.3 allows remote attackers to cause remote code execution (heap-based buffer overflow) via a crafted mobi file.

References (1)

Core 1

Core References

Exploit, Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc

http://seclists.org/fulldisclosure/2018/May/48

Scores

CVSS v3 8.8

EPSS 0.0267

EPSS Percentile 84.0%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-787

Status published

Products (1)

libmobi_project/libmobi 0.3

Published May 30, 2018

Tracked Since Feb 18, 2026