CVE-2018-11130
The header::add_FORMAT_descriptor function in header.cpp in VCFtools 0.1.15 allows remote...
The header::add_FORMAT_descriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted vcf file.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The header::add_FORMAT_descriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted vcf file.
- Record
CVE-2018-11130- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-416
- Updated
- 2026-11-02
CVE List No score
The header::add_FORMAT_descriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted vcf file.
- Record
CVE-2018-11130- Updated
- 2026-11-02
EUVDEUVD-2018-3172 No score
The header::add_FORMAT_descriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted vcf file.
- Record
EUVD-2018-3172- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jj62-5hxc-24xq
The header::add_FORMAT_descriptor function in header.cpp in VCFtools 0.1.15 allows remote...
The header::add_FORMAT_descriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted vcf file.
- Record
GHSA-jj62-5hxc-24xq- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
OSV
The header::add_FORMAT_descriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted vcf file.
- Record
CVE-2018-11130- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-11130
The header::add_FORMAT_descriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted vcf file.
- Record
DEBIAN-CVE-2018-11130- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-11130
The header::add_FORMAT_descriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted vcf file.
- Record
UBUNTU-CVE-2018-11130- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUSN-3974-1 No score
VCFtools vulnerabilities
It was discovered that VCFtools improperly handled certain input. If a user was tricked into opening a crafted input file, VCFtools could be made to crash. (CVE-2018-11099, CVE-2018-11129, CVE-2018-11130)
- Record
USN-3974-1- Updated
- 2026-11-02
OSVUSN-4835-1 No score
vcftools vulnerabilities
It was discovered that VCFtools improperly handled certain input. If a user were tricked into opening a crafted input file, VCFtools could be made to crash or possibly cause other unspecified impact. (CVE-2018-11099, CVE-2018-11129, CVE-2018-11130)
It was discovered that VCFtools improperly handled memory allocation/deallocation, resulting in a use-after-free vulnerability. If a victim were tricked into opening a specially crafted VCF File, an attacker could cause VCFtools to leak sensitive information or possibly execute arbitrary code. (CVE-2019-1010127)
- Record
USN-4835-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
vcftoolsDebian:12 |
before 0.1.16-1 | 0.1.16-1 |
vcftoolsDebian:13 |
before 0.1.16-1 | 0.1.16-1 |
vcftoolsDebian:14 |
before 0.1.16-1 | 0.1.16-1 |
vcftoolsDebian:8 |
before 0.1.12+dfsg-1+deb8u1, plus listed versions 0.1.12+dfsg-1 |
0.1.12+dfsg-1+deb8u1 |
vcftoolsUbuntu:Pro:14.04:LTS |
before 0.1.11+dfsg-1ubuntu0.1~esm1, plus listed versions 0.1.11+dfsg-1 |
0.1.11+dfsg-1ubuntu0.1~esm1 |
vcftoolsUbuntu:16.04:LTS |
before 0.1.14+dfsg-2ubuntu0.1, plus listed versions 0.1.13+dfsg-10.1.14+dfsg-10.1.14+dfsg-2 |
0.1.14+dfsg-2ubuntu0.1 |
vcftoolsUbuntu:Pro:18.04:LTS |
before 0.1.15-1ubuntu0.1~esm1, plus listed versions 0.1.14+dfsg-40.1.15-1 |
0.1.15-1ubuntu0.1~esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-11130 is a high vulnerability (CVSS 7.8) in Vcftools Project Vcftools, published May 17, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 20.1%, the 97th percentile. Fixed in vcftools 0.1.16-1.