CVE-2018-7548
In subst.c in zsh through 5.4.2, there is a NULL pointer dereference when using ${(PA)...} on an...
In subst.c in zsh through 5.4.2, there is a NULL pointer dereference when using ${(PA)...} on an empty array result.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In subst.c in zsh through 5.4.2, there is a NULL pointer dereference when using ${(PA)...} on an empty array result.
- Record
CVE-2018-7548- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-476
- Updated
- 2026-11-02
CVE List No score
In subst.c in zsh through 5.4.2, there is a NULL pointer dereference when using ${(PA)...} on an empty array result.
- Record
CVE-2018-7548- Updated
- 2026-11-02
EUVDEUVD-2018-19275 No score
In subst.c in zsh through 5.4.2, there is a NULL pointer dereference when using ${(PA)...} on an empty array result.
- Record
EUVD-2018-19275- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-52h6-vcv4-gr3c
In subst.c in zsh through 5.4.2, there is a NULL pointer dereference when using ${(PA)...} on an...
In subst.c in zsh through 5.4.2, there is a NULL pointer dereference when using ${(PA)...} on an empty array result.
- Record
GHSA-52h6-vcv4-gr3c- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
OSV
In subst.c in zsh through 5.4.2, there is a NULL pointer dereference when using ${(PA)...} on an empty array result.
- Record
CVE-2018-7548- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-7548
In subst.c in zsh through 5.4.2, there is a NULL pointer dereference when using ${(PA)...} on an empty array result.
- Record
DEBIAN-CVE-2018-7548- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2018-0168 No score
Updated zsh packages fix security vulnerabilities
Zsh has been updated to fix 4 security issues.
In builtin.c in zsh before 5.4, when sh compatibility mode is used, there is a NULL pointer dereference during processing of the cd command with no argument if HOME is not set. (CVE-2017-18205)
In utils.c in zsh before 5.4, symlink expansion had a buffer overflow. (CVE-2017-18206)
In subst.c in zsh through 5.4.2, there is a NULL pointer dereference when using ${(PA)...} on an empty array result.(CVE-2018-7548)
In params.c in zsh through 5.4.2, there is a crash during a copy of an empty hash table, as demonstrated by typeset -p. (CVE-2018-7549)
- Record
MGASA-2018-0168- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-7548 is a critical vulnerability (CVSS 9.8) in Zsh, published February 27, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.54%, the 85th percentile. Fixed in zsh 5.5-1.
References
usn.ubuntu.com/3593-1
security.gentoo.org/glsa/201805-10
sourceforge.net/p/zsh/code/ci/110b13e1090bc31ac1352b28adc2d02b6d25a102
nvd.nist.gov/vuln/detail/CVE-2018-7548
github.com/advisories/GHSA-52h6-vcv4-gr3c
security-tracker.debian.org/tracker/CVE-2018-7548
advisories.mageia.org/MGASA-2018-0168.html
bugs.mageia.org/show_bug.cgi?id=22741