CVE-2018-7186
Leptonica before 1.75.3 does not limit the number of characters in a %s format argument to fscanf...
Leptonica before 1.75.3 does not limit the number of characters in a %s format argument to fscanf or sscanf, which allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a long string, as demonstrated by the gplotRead and ptaReadStream functions.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Leptonica before 1.75.3 does not limit the number of characters in a %s format argument to fscanf or sscanf, which allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a long string, as demonstrated by the gplotRead and ptaReadStream functions.
- Record
CVE-2018-7186- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-787
- Updated
- 2026-11-02
CVE List No score
Leptonica before 1.75.3 does not limit the number of characters in a %s format argument to fscanf or sscanf, which allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a long string, as demonstrated by the gplotRead and ptaReadStream functions.
- Record
CVE-2018-7186- Updated
- 2026-11-02
EUVDEUVD-2018-18928 No score
Leptonica before 1.75.3 does not limit the number of characters in a %s format argument to fscanf or sscanf, which allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a long string, as demonstrated by the gplotRead and ptaReadStream functions.
- Record
EUVD-2018-18928- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hx3c-v527-xcjq
Leptonica before 1.75.3 does not limit the number of characters in a %s format argument to fscanf...
Leptonica before 1.75.3 does not limit the number of characters in a %s format argument to fscanf or sscanf, which allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a long string, as demonstrated by the gplotRead and ptaReadStream functions.
- Record
GHSA-hx3c-v527-xcjq- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
OSV
Leptonica before 1.75.3 does not limit the number of characters in a %s format argument to fscanf or sscanf, which allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a long string, as demonstrated by the gplotRead and ptaReadStream functions.
- Record
CVE-2018-7186- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-7186
Leptonica before 1.75.3 does not limit the number of characters in a %s format argument to fscanf or sscanf, which allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a long string, as demonstrated by the gplotRead and ptaReadStream functions.
- Record
DEBIAN-CVE-2018-7186- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2018-7186
Leptonica before 1.75.3 does not limit the number of characters in a %s format argument to fscanf or sscanf, which allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a long string, as demonstrated by the gplotRead and ptaReadStream functions.
- Record
UBUNTU-CVE-2018-7186- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2018-0175 No score
Updated leptonica packages fix security vulnerabilities
Package leptonica has been updated to the current stable version 1.75.3 which fixes:
CVE-2018-7186 - multiple stack-based buffer overflows in gplotRead() and ptaReadStream()
CVE-2018-7247 - a buffer overflow in src/viewfiles.c with unsanitized input (rootname)
- Record
MGASA-2018-0175- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10914-1 No score
leptonica-devel-1.80.0-1.9 on GA media
These are all security issues fixed in the leptonica-devel-1.80.0-1.9 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10914-1- Updated
- 2026-11-02
OSVUSN-4819-1 No score
leptonlib vulnerabilities
It was discovered that Leptonica incorrectly handled path names. An attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 16.04 ESM. (CVE-2017-18196)
It was discovered that Leptonica incorrectly handled certain input arguments. An attacker could possibly use this issue to execute arbitrary commands. (CVE-2018-3836)
It was discovered that Leptonica incorrectly handled input arguments. An attacker could possibly use this issue to cause a denial of service or other unspecified impact. (CVE-2018-7186)
- Record
USN-4819-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
leptonlibDebian:12 |
before 1.75.3-2 | 1.75.3-2 |
leptonlibDebian:13 |
before 1.75.3-2 | 1.75.3-2 |
leptonlibDebian:14 |
before 1.75.3-2 | 1.75.3-2 |
leptonlibDebian:7 From an advisory covering 2 CVEs |
before 1.69-3.1+deb7u2, plus listed versions 1.69-3.11.69-3.1+deb7u1 |
1.69-3.1+deb7u2 |
leptonicaMageia:6 From an advisory covering 2 CVEs |
before 1.75.3-1.mga6 | 1.75.3-1.mga6 |
mingw-leptonicaMageia:6 From an advisory covering 2 CVEs |
before 1.75.3-1.mga6 | 1.75.3-1.mga6 |
leptonlibUbuntu:Pro:14.04:LTS |
before 1.70.1-1ubuntu0.1~esm1, plus listed versions 1.69-4ubuntu11.69-4ubuntu21.69-4ubuntu31.69-4ubuntu41.70.1-1 |
1.70.1-1ubuntu0.1~esm1 |
leptonlibUbuntu:Pro:16.04:LTS |
before 1.73-1ubuntu0.1~esm1, plus listed versions 1.72-31.72-3build11.73-1 |
1.73-1ubuntu0.1~esm1 |
leptonlibUbuntu:Pro:14.04:LTS From an advisory covering 3 CVEs |
before 1.70.1-1ubuntu0.1~esm1, plus listed versions 1.69-4ubuntu11.69-4ubuntu21.69-4ubuntu31.69-4ubuntu41.70.1-1 |
1.70.1-1ubuntu0.1~esm1 |
leptonlibUbuntu:Pro:16.04:LTS From an advisory covering 3 CVEs |
before 1.73-1ubuntu0.1~esm1, plus listed versions 1.72-31.72-3build11.73-1 |
1.73-1ubuntu0.1~esm1 |
leptonicaopenSUSE:Tumbleweed From an advisory covering 7 CVEs |
before 1.80.0-1.9 | 1.80.0-1.9 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-7186 is a critical vulnerability (CVSS 9.8) in Leptonica, published February 16, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.40%, the 88th percentile. Fixed in leptonlib 1.75.3-2.
References
lists.debian.org/debian-lts-announce/2018/03/msg00005.html
github.com/DanBloomberg/leptonica/commit/ee301cb2029db8a6289c5295daa42bba7715e99a
bugs.debian.org/890548
security.gentoo.org/glsa/202312-01
nvd.nist.gov/vuln/detail/CVE-2018-7186
Show 16 moreShow less
security-tracker.debian.org/tracker/CVE-2018-7186
advisories.mageia.org/MGASA-2018-0175.html
bugs.mageia.org/show_bug.cgi?id=22742
ubuntu.com/security/CVE-2018-7186
cve.org/CVERecord?id=CVE-2018-7186
suse.com/security/cve/CVE-2017-18196