CVE-2019-10978

HIGH

Red Lion Crimson < 3.0 and 3.1 < 3112.00 - Memory Corruption via Malicious Input File

Title source: llm
STIX 2.1

Description

Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, allow multiple vulnerabilities to be exploited when a valid user opens a specially crafted, malicious input file that operates outside of the designated memory area.

References (1)

Core 1
Core References
Third Party Advisory, US Government Resource x_refsource_misc
https://www.us-cert.gov/ics/advisories/icsa-19-248-01

Scores

CVSS v3 7.8
EPSS 0.0086
EPSS Percentile 54.0%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-119
Status published
Products (2)
None/Red Lion Controls Crimson (Windows configuration software) Version 3.0 and prior, Version 3.1 prior to release 3112.00
redlion/crimson < 3.0
Published Sep 23, 2019
Tracked Since Feb 18, 2026