CVE-2018-25154 | GNU Barcode 0.99 contains a buffer overflow vulnerability in… | CVSS 9.8 CRITICAL

Description

GNU Barcode 0.99 contains a buffer overflow vulnerability in its code 93 encoding process that allows attackers to trigger memory corruption. Attackers can exploit boundary errors during input file processing to potentially execute arbitrary code on the affected system.

Metadata

CVE ID: CVE-2018-25154
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2025-12-24 14:28 UTC
Published: 2025-12-24 19:27 UTC
Last updated: 2026-04-07 14:03 UTC
Primary CWE: CWE-787
Out-of-bounds Write
Vendor / Product: The GNU Project | Free Software Foundation, Inc. / GNU Barcode
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
The GNU Project \| Free Software Foundation, Inc.	GNU Barcode	—	0.99

Weakness (CWE)

CWE	Source	Description
CWE-787	cna	Out-of-bounds Write

CVSS scores (2)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
8.5	HIGH	4.0	cna	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References (3)

ExploitDB-44797 https://www.exploit-db.com/exploits/44797
GNU Barcode Official Product Page https://www.gnu.org/software/barcode/
FSF Directory Entry for Barcode https://directory.fsf.org/wiki/Barcode