CVE-2018-20349

The igraph_i_strdiff function in igraph_trie.c in igraph through 0.7.1 has an NULL pointer...

6.5 MediumFix available

The igraph_i_strdiff function in igraph_trie.c in igraph through 0.7.1 has an NULL pointer dereference that allows attackers to cause a denial of service (application crash) via a crafted object.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

1.60%Up 0.3 points since Apr 14, 2021

What each source reports

NVD Score used 6.5

The igraph_i_strdiff function in igraph_trie.c in igraph through 0.7.1 has an NULL pointer dereference that allows attackers to cause a denial of service (application crash) via a crafted object.

Record: CVE-2018-20349
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness: CWE-476
Updated: 2026-11-02

CVE List No score

The igraph_i_strdiff function in igraph_trie.c in igraph through 0.7.1 has an NULL pointer dereference that allows attackers to cause a denial of service (application crash) via a crafted object.

Record: CVE-2018-20349
Updated: 2026-11-02

EUVDEUVD-2018-12907 No score

The igraph_i_strdiff function in igraph_trie.c in igraph through 0.7.1 has an NULL pointer dereference that allows attackers to cause a denial of service (application crash) via a crafted object.

Record: EUVD-2018-12907
Updated: 2026-11-03

GitHub AdvisoriesGHSA-qgqh-phj7-7fm4 6.5

The igraph_i_strdiff function in igraph_trie.c in igraph through 0.7.1 has an NULL pointer...

The igraph_i_strdiff function in igraph_trie.c in igraph through 0.7.1 has an NULL pointer dereference that allows attackers to cause a denial of service (application crash) via a crafted object.

Record: GHSA-qgqh-phj7-7fm4
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-476
Updated: 2026-11-02

OSV 6.5

The igraph_i_strdiff function in igraph_trie.c in igraph through 0.7.1 has an NULL pointer dereference that allows attackers to cause a denial of service (application crash) via a crafted object.

Record: CVE-2018-20349
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2018-20349 6.5

The igraph_i_strdiff function in igraph_trie.c in igraph through 0.7.1 has an NULL pointer dereference that allows attackers to cause a denial of service (application crash) via a crafted object.

Record: DEBIAN-CVE-2018-20349
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 4 moreShow less

OSVUBUNTU-CVE-2018-20349 6.5

The igraph_i_strdiff function in igraph_trie.c in igraph through 0.7.1 has an NULL pointer dereference that allows attackers to cause a denial of service (application crash) via a crafted object.

Record: UBUNTU-CVE-2018-20349
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVMGASA-2020-0013 No score

Updated igraph packages fix security vulnerability

Updated igraph packages fix security vulnerability:

The igraph_i_strdiff function in igraph_trie.c in igraph through 0.7.1 has an NULL pointer dereference that allows attackers to cause a denial of service (application crash) via a crafted object (CVE-2018-20349).

Record: MGASA-2020-0013
Updated: 2026-11-02

OSVRSEC-2023-4 No score

NULL pointer dereference vulnerability

The igraph R package, through version 0.7.1, is susceptible to a vulnerability identified in the igraph_i_strdiff function within igraph_trie.c. This vulnerability can lead to a NULL pointer dereference, potentially exploited by attackers to cause a denial of service, resulting in an application crash. Users of the igraph package should take necessary precautions and consider updating to a patched version to mitigate this security risk.

Record: RSEC-2023-4
Updated: 2026-11-02

OSVUSN-4644-1 No score

igraph vulnerability

It was discovered that igraph mishandled certain malformed XML. An attacker could use this vulnerability to cause a denial of service (crash).

Record: USN-4644-1
Updated: 2026-11-02

Affected products

igraph

Affected packages

Affected packages
Package	Affected	Fixed
`igraph` Debian:12	before 0.7.1-3	0.7.1-3
`igraph` Debian:13	before 0.7.1-3	0.7.1-3
`igraph` Debian:14	before 0.7.1-3	0.7.1-3
`r-cran-igraph` Debian:12	before 1.2.2-2	1.2.2-2
`r-cran-igraph` Debian:13	before 1.2.2-2	1.2.2-2
`r-cran-igraph` Debian:14	before 1.2.2-2	1.2.2-2
`igraph` Debian:8	before 0.7.1-2+deb8u1, plus listed versions 0.7.1-2	0.7.1-2+deb8u1
`igraph` Mageia:7	before 0.7.1-2.1.mga7	0.7.1-2.1.mga7
`igraph` CRAN	0.7.1 up to 1.2.2-2, plus listed versions 1.0.01.0.11.1.11.1.21.2.11.2.2	1.2.2-2
`igraph` Ubuntu:16.04:LTS	before 0.7.1-2.1+deb9u1build0.16.04.1, plus listed versions 0.7.1-2.1	0.7.1-2.1+deb9u1build0.16.04.1
`igraph` Ubuntu:18.04:LTS	before 0.7.1-2.1+deb9u1build0.18.04.1, plus listed versions 0.7.1-2.1build2	0.7.1-2.1+deb9u1build0.18.04.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-20349 is a medium vulnerability (CVSS 6.5) in Igraph, published December 22, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.60%, the 75th percentile. Fixed in igraph 0.7.1-3.

References

Show 9 moreShow less