CVE-2018-16430

GNU Libextractor through 1.7 has an out-of-bounds read vulnerability in...

8.8 HighFix available

CVE-2018-16430 is a high vulnerability (CVSS 8.8) in Gnu Libextractor, published September 4, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.63%, the 85th percentile. Fixed in libextractor 1:1.7-1.

GNU Libextractor through 1.7 has an out-of-bounds read vulnerability in EXTRACTOR_zip_extract_method() in zip_extractor.c.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

2.63%Up 1.4 points since Apr 14, 2021

What each source reports

NVD Score used 8.8

GNU Libextractor through 1.7 has an out-of-bounds read vulnerability in EXTRACTOR_zip_extract_method() in zip_extractor.c.

Record: CVE-2018-16430
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-125
Updated: 2026-11-02

CVE List No score

GNU Libextractor through 1.7 has an out-of-bounds read vulnerability in EXTRACTOR_zip_extract_method() in zip_extractor.c.

Record: CVE-2018-16430
Updated: 2026-11-02

EUVDEUVD-2018-8270 No score

GNU Libextractor through 1.7 has an out-of-bounds read vulnerability in EXTRACTOR_zip_extract_method() in zip_extractor.c.

Record: EUVD-2018-8270
Updated: 2026-11-03

GitHub AdvisoriesGHSA-8fr9-2wh5-f97x 8.8

GNU Libextractor through 1.7 has an out-of-bounds read vulnerability in...

GNU Libextractor through 1.7 has an out-of-bounds read vulnerability in EXTRACTOR_zip_extract_method() in zip_extractor.c.

Record: GHSA-8fr9-2wh5-f97x
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-125
Updated: 2026-11-02

OSV 8.8

GNU Libextractor through 1.7 has an out-of-bounds read vulnerability in EXTRACTOR_zip_extract_method() in zip_extractor.c.

Record: CVE-2018-16430
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2018-16430 8.8

GNU Libextractor through 1.7 has an out-of-bounds read vulnerability in EXTRACTOR_zip_extract_method() in zip_extractor.c.

Record: DEBIAN-CVE-2018-16430
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2018-16430 8.8

GNU Libextractor through 1.7 has an out-of-bounds read vulnerability in EXTRACTOR_zip_extract_method() in zip_extractor.c.

Record: UBUNTU-CVE-2018-16430
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUSN-4641-1 No score

libextractor vulnerabilities

It was discovered that Libextractor incorrectly handled zero sample rate. An attacker could possibly use this issue to cause a denial of service. (CVE-2017-15266)

It was discovered that Libextractor incorrectly handled certain FLAC metadata. An attacker could possibly use this issue to cause a denial of service. (CVE-2017-15267)

It was discovered that Libextractor incorrectly handled certain specially crafted files. An attacker could possibly use this issue to cause a denial of service. (CVE-2017-15600, CVE-2018-16430, CVE-2018-20430)

It was discovered that Libextractor incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service. (CVE-2017-15601)

It was discovered that Libextractor incorrectly handled integers. An attacker could possibly use this issue to cause a denial of service. (CVE-2017-15602)

It was discovered that Libextractore incorrectly handled certain crafted files. An attacker could possibly use this issue to cause a denial of service. (CVE-2017-15922)

It was discovered tha Libextractor incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service. (CVE-2017-17440)

It was discovered that Libextractor incorrectly handled certain malformed files. An attacker could possibly use this issue to cause a denial of service. (CVE-2018-14346)

It was discovered that Libextractor incorrectly handled malformed files. An attacker could possibly use this issue to cause a denial of service. (CVE-2018-14347)

It was discovered that Libextractor incorrectly handled metadata. An attacker could possibly use this issue to cause a denial of service. (CVE-2018-20431)

Record: USN-4641-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`libextractor` Debian:12	before 1:1.7-1	1:1.7-1
`libextractor` Debian:13	before 1:1.7-1	1:1.7-1
`libextractor` Debian:14	before 1:1.7-1	1:1.7-1
`libextractor` Debian:8	before 1:1.3-2+deb8u3, plus listed versions 1:1.3-21:1.3-2+deb8u11:1.3-2+deb8u2	1:1.3-2+deb8u3
`libextractor` Debian:9	before 1:1.3-4+deb9u2, plus listed versions 1:1.3-41:1.3-4+deb9u1	1:1.3-4+deb9u2
`libextractor` Ubuntu:Pro:14.04:LTS	before 1:1.3-1ubuntu0.1~esm1, plus listed versions 1:1.1-1ubuntu11:1.2-1ubuntu11:1.3-1	1:1.3-1ubuntu0.1~esm1
`libextractor` Ubuntu:16.04:LTS	before 1:1.3-4+deb9u3build0.16.04.1, plus listed versions 1:1.3-2build11:1.3-2ubuntu11:1.3-3	1:1.3-4+deb9u3build0.16.04.1
`libextractor` Ubuntu:18.04:LTS	All versions, plus listed versions 1:1.3-4build31:1.6-11:1.6-1build11:1.6-2	None known

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 16 moreShow less