CVE-2018-11129
The header::add_INFO_descriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers...
CVE-2018-11129 is a high vulnerability (CVSS 7.8) in Vcftools Project Vcftools, published May 17, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.41%, the 72nd percentile. Fixed in vcftools 0.1.16-1.
The header::add_INFO_descriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted vcf file.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The header::add_INFO_descriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted vcf file.
- Record
CVE-2018-11129- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-416
- Updated
- 2026-11-02
CVE List No score
The header::add_INFO_descriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted vcf file.
- Record
CVE-2018-11129- Updated
- 2026-11-02
EUVDEUVD-2018-3171 No score
The header::add_INFO_descriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted vcf file.
- Record
EUVD-2018-3171- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hj8w-chvp-5f9p
The header::add_INFO_descriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers...
The header::add_INFO_descriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted vcf file.
- Record
GHSA-hj8w-chvp-5f9p- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
OSV
The header::add_INFO_descriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted vcf file.
- Record
CVE-2018-11129- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-11129
The header::add_INFO_descriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted vcf file.
- Record
DEBIAN-CVE-2018-11129- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-11129
The header::add_INFO_descriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted vcf file.
- Record
UBUNTU-CVE-2018-11129- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUSN-3974-1 No score
VCFtools vulnerabilities
It was discovered that VCFtools improperly handled certain input. If a user was tricked into opening a crafted input file, VCFtools could be made to crash. (CVE-2018-11099, CVE-2018-11129, CVE-2018-11130)
- Record
USN-3974-1- Updated
- 2026-11-02
OSVUSN-4835-1 No score
vcftools vulnerabilities
It was discovered that VCFtools improperly handled certain input. If a user were tricked into opening a crafted input file, VCFtools could be made to crash or possibly cause other unspecified impact. (CVE-2018-11099, CVE-2018-11129, CVE-2018-11130)
It was discovered that VCFtools improperly handled memory allocation/deallocation, resulting in a use-after-free vulnerability. If a victim were tricked into opening a specially crafted VCF File, an attacker could cause VCFtools to leak sensitive information or possibly execute arbitrary code. (CVE-2019-1010127)
- Record
USN-4835-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
vcftoolsDebian:12 |
before 0.1.16-1 | 0.1.16-1 |
vcftoolsDebian:13 |
before 0.1.16-1 | 0.1.16-1 |
vcftoolsDebian:14 |
before 0.1.16-1 | 0.1.16-1 |
vcftoolsDebian:8 |
before 0.1.12+dfsg-1+deb8u1, plus listed versions 0.1.12+dfsg-1 |
0.1.12+dfsg-1+deb8u1 |
vcftoolsUbuntu:Pro:14.04:LTS |
before 0.1.11+dfsg-1ubuntu0.1~esm1, plus listed versions 0.1.11+dfsg-1 |
0.1.11+dfsg-1ubuntu0.1~esm1 |
vcftoolsUbuntu:16.04:LTS |
before 0.1.14+dfsg-2ubuntu0.1, plus listed versions 0.1.13+dfsg-10.1.14+dfsg-10.1.14+dfsg-2 |
0.1.14+dfsg-2ubuntu0.1 |
vcftoolsUbuntu:Pro:18.04:LTS |
before 0.1.15-1ubuntu0.1~esm1, plus listed versions 0.1.14+dfsg-40.1.15-1 |
0.1.15-1ubuntu0.1~esm1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |