Every CVE Search/ Get API key

CVE-2017-3158

Apache Guacamole Race Condition vulnerability

8.1 HighFix available

A race condition in Guacamole's terminal emulator in versions 0.9.5 through 0.9.10-incubating could allow writes of blocks of printed data to overlap. Such overlapping writes could cause packet data to be misread as the packet length, resulting in the remaining data being written beyond the end of a statically-allocated buffer.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.22%Unchanged since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 8.1

A race condition in Guacamole's terminal emulator in versions 0.9.5 through 0.9.10-incubating could allow writes of blocks of printed data to overlap. Such overlapping writes could cause packet data to be misread as the packet length, resulting in the remaining data being written beyond the end of a statically-allocated buffer.

Record
CVE-2017-3158
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-362
Updated
2026-11-02
CVE List No score

A race condition in Guacamole's terminal emulator in versions 0.9.5 through 0.9.10-incubating could allow writes of blocks of printed data to overlap. Such overlapping writes could cause packet data to be misread as the packet length, resulting in the remaining data being written beyond the end of a statically-allocated buffer.

Record
CVE-2017-3158
Updated
2026-11-02
EUVDEUVD-2022-2246 No score

A race condition in Guacamole's terminal emulator in versions 0.9.5 through 0.9.10-incubating could allow writes of blocks of printed data to overlap. Such overlapping writes could cause packet data to be misread as the packet length, resulting in the remaining data being written beyond the end of a statically-allocated buffer.

Record
EUVD-2022-2246
Updated
2026-11-03
GitHub AdvisoriesGHSA-3vv3-585q-wv6x 8.1

Apache Guacamole Race Condition vulnerability

A race condition in Guacamole's terminal emulator in versions 0.9.5 through 0.9.10-incubating could allow writes of blocks of printed data to overlap. Such overlapping writes could cause packet data to be misread as the packet length, resulting in the remaining data being written beyond the end of a statically-allocated buffer.

Record
GHSA-3vv3-585q-wv6x
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-362
Updated
2026-11-02
OSV 8.1

A race condition in Guacamole's terminal emulator in versions 0.9.5 through 0.9.10-incubating could allow writes of blocks of printed data to overlap. Such overlapping writes could cause packet data to be misread as the packet length, resulting in the remaining data being written beyond the end of a statically-allocated buffer.

Record
CVE-2017-3158
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-3vv3-585q-wv6x 8.1

Apache Guacamole Race Condition vulnerability

A race condition in Guacamole's terminal emulator in versions 0.9.5 through 0.9.10-incubating could allow writes of blocks of printed data to overlap. Such overlapping writes could cause packet data to be misread as the packet length, resulting in the remaining data being written beyond the end of a statically-allocated buffer.

Record
GHSA-3vv3-585q-wv6x
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-362
Updated
2026-11-02
OSVUBUNTU-CVE-2017-3158 8.1

A race condition in Guacamole's terminal emulator in versions 0.9.5 through 0.9.10-incubating could allow writes of blocks of printed data to overlap. Such overlapping writes could cause packet data to be misread as the packet length, resulting in the remaining data being written beyond the end of a statically-allocated buffer.

Record
UBUNTU-CVE-2017-3158
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.guacamole:guacamole-common
Maven
0.9.5 up to 0.9.11-incubating
0.9.11-incubating
org.apache.guacamole:guacamole-common
Maven
0.9.5 up to 0.9.11-incubating, plus listed versions
0.9.10-incubating
0.9.11-incubating
guacamole-client
Ubuntu:16.04:LTS
All versions, plus listed versions
0.8.3-1.10.8.3-1.2
None known
guacamole-server
Ubuntu:16.04:LTS
All versions, plus listed versions
0.8.3-1build20.8.3-2
None known
guacamole-client
Ubuntu:18.04:LTS
All versions, plus listed versions
0.9.9+dfsg-1
None known
guacamole-server
Ubuntu:18.04:LTS
All versions, plus listed versions
0.9.9-20.9.9-2build1
None known
guacamole-server
Ubuntu:22.04:LTS
All versions, plus listed versions
1.3.0-11.3.0-1build11.3.0-1.1
None known
guacamole-server
Ubuntu:24.04:LTS
All versions, plus listed versions
1.3.0-1.11.3.0-1.3ubuntu1
None known

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-3158 is a high vulnerability (CVSS 8.1) in Apache Guacamole, published January 18, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.22%, the 68th percentile. Fixed in org.apache.guacamole:guacamole-common 0.9.11-incubating.

References

MoveEnter Open