Every CVE Search/ Get API key

CVE-2018-10115

Incorrect initialization logic of RAR decoder objects in 7-Zip 18.03 and before can lead to usage...

7.8 HighFix available

Incorrect initialization logic of RAR decoder objects in 7-Zip 18.03 and before can lead to usage of uninitialized memory, allowing remote attackers to cause a denial of service (segmentation fault) or execute arbitrary code via a crafted RAR archive.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

4.51%Up 1.7 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.8

Incorrect initialization logic of RAR decoder objects in 7-Zip 18.03 and before can lead to usage of uninitialized memory, allowing remote attackers to cause a denial of service (segmentation fault) or execute arbitrary code via a crafted RAR archive.

Record
CVE-2018-10115
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-665, CWE-908
Updated
2026-11-02
CVE List No score

Incorrect initialization logic of RAR decoder objects in 7-Zip 18.03 and before can lead to usage of uninitialized memory, allowing remote attackers to cause a denial of service (segmentation fault) or execute arbitrary code via a crafted RAR archive.

Record
CVE-2018-10115
Updated
2026-11-02
EUVDEUVD-2018-2194 No score

Incorrect initialization logic of RAR decoder objects in 7-Zip 18.03 and before can lead to usage of uninitialized memory, allowing remote attackers to cause a denial of service (segmentation fault) or execute arbitrary code via a crafted RAR archive.

Record
EUVD-2018-2194
Updated
2026-11-03
GitHub AdvisoriesGHSA-75r2-jhx8-x356 7.8

Incorrect initialization logic of RAR decoder objects in 7-Zip 18.03 and before can lead to usage...

Incorrect initialization logic of RAR decoder objects in 7-Zip 18.03 and before can lead to usage of uninitialized memory, allowing remote attackers to cause a denial of service (segmentation fault) or execute arbitrary code via a crafted RAR archive.

Record
GHSA-75r2-jhx8-x356
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-665
Updated
2026-11-02
OSVALPINE-CVE-2018-10115 7.8

Incorrect initialization logic of RAR decoder objects in 7-Zip 18.03 and before can lead to usage of uninitialized memory, allowing remote attackers to cause a denial of service (segmentation fault) or execute arbitrary code via a crafted RAR archive.

Record
ALPINE-CVE-2018-10115
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 7.8

Incorrect initialization logic of RAR decoder objects in 7-Zip 18.03 and before can lead to usage of uninitialized memory, allowing remote attackers to cause a denial of service (segmentation fault) or execute arbitrary code via a crafted RAR archive.

Record
CVE-2018-10115
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2018-10115 7.8

Incorrect initialization logic of RAR decoder objects in 7-Zip 18.03 and before can lead to usage of uninitialized memory, allowing remote attackers to cause a denial of service (segmentation fault) or execute arbitrary code via a crafted RAR archive.

Record
DEBIAN-CVE-2018-10115
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2021-1294 7.8

p7zip security update

7za for Linux system to archive file as 7z file format

Security Fix(es):

Heap-based buffer overflow in the NCompress::NShrink::CDecoder::CodeReal method in 7-Zip before 18.00 and p7zip allows remote attackers to cause a denial of service (out-of-bounds write) or potentially execute arbitrary code via a crafted ZIP archive.(CVE-2017-17969)

Insufficient exception handling in the method NCompress::NRar3::CDecoder::Code of 7-Zip before 18.00 and p7zip can lead to multiple memory corruptions within the PPMd code, allows remote attackers to cause a denial of service (segmentation fault) or execute arbitrary code via a crafted RAR archive.(CVE-2018-5996)

Incorrect initialization logic of RAR decoder objects in 7-Zip 18.03 and before can lead to usage of uninitialized memory, allowing remote attackers to cause a denial of service (segmentation fault) or execute arbitrary code via a crafted RAR archive.(CVE-2018-10115)

A null pointer dereference bug affects the 16.02 and many old versions of p7zip. A lack of null pointer check for the variable folders.PackPositions in function CInArchive::ReadAndDecodePackedStreams in CPP/7zip/Archive/7z/7zIn.cpp, as used in the 7z.so library and in 7z applications, will cause a crash and a denial of service when decoding malformed 7z files.(CVE-2016-9296)

Record
OESA-2021-1294
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2018-10115 7.8

Incorrect initialization logic of RAR decoder objects in 7-Zip 18.03 and before can lead to usage of uninitialized memory, allowing remote attackers to cause a denial of service (segmentation fault) or execute arbitrary code via a crafted RAR archive.

Record
UBUNTU-CVE-2018-10115
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
p7zip
Alpine:v3.10
 before 16.02-r3
16.02-r3
p7zip
Alpine:v3.11
 before 16.02-r3
16.02-r3
p7zip
Alpine:v3.12
 before 16.02-r3
16.02-r3
p7zip
Alpine:v3.13
 before 16.02-r3
16.02-r3
p7zip
Alpine:v3.14
 before 16.02-r3
16.02-r3
p7zip
Alpine:v3.15
 before 16.02-r3
16.02-r3
p7zip
Alpine:v3.16
 before 16.02-r3
16.02-r3
p7zip
Alpine:v3.17
 before 16.02-r3
16.02-r3
p7zip
Alpine:v3.5
 before 16.02-r3
16.02-r3
p7zip
Alpine:v3.6
 before 16.02-r3
16.02-r3
Show 8 moreShow less
Affected packages
PackageAffectedFixed
p7zip
Alpine:v3.7
 before 16.02-r3
16.02-r3
p7zip
Alpine:v3.8
 before 16.02-r3
16.02-r3
p7zip
Alpine:v3.9
 before 16.02-r3
16.02-r3
p7zip-rar
Debian:12
 before 16.02-3, plus listed versions
15.09-115.09-215.14.1-116.02-116.02-2
Show 16 moreShow less
4.44-14.44.ds.1-14.45~ds.1-14.47~ds.1-14.51~ds.1-14.55~ds.1-14.55~ds.1-24.57~ds.1-14.58~ds.1-14.61~ds.1-14.65~ds.1-19.04~ds.1-19.20.1~ds.1-19.20.1~ds.1-29.20.1~ds.1-39.20.1~ds.1-4
16.02-3
p7zip-rar
Debian:13
 before 16.02-3, plus listed versions
15.09-115.09-215.14.1-116.02-116.02-2
Show 16 moreShow less
4.44-14.44.ds.1-14.45~ds.1-14.47~ds.1-14.51~ds.1-14.55~ds.1-14.55~ds.1-24.57~ds.1-14.58~ds.1-14.61~ds.1-14.65~ds.1-19.04~ds.1-19.20.1~ds.1-19.20.1~ds.1-29.20.1~ds.1-39.20.1~ds.1-4
16.02-3
p7zip
openEuler:20.03-LTS-SP2
 before 16.02-3.oe1
16.02-3.oe1
p7zip-rar
Ubuntu:16.04:LTS
 All versions, plus listed versions
9.20.1~ds.1-39.20.1~ds.1-4
 None known
p7zip-rar
Ubuntu:18.04:LTS
 All versions, plus listed versions
16.02-116.02-2
 None known

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-10115 is a high vulnerability (CVSS 7.8) in 7-zip, published May 2, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.51%, the 91st percentile. Fixed in p7zip 16.02-r3.

References

Show 8 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open