CVE-2018-14346

GNU Libextractor before 1.7 has a stack-based buffer overflow in ec_read_file_func (unzip.c).

8.8 HighFix available

CVE-2018-14346 is a high vulnerability (CVSS 8.8) in Gnu Libextractor, published July 17, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.11%, the 81st percentile. Fixed in libextractor 1:1.7-1.

GNU Libextractor before 1.7 has a stack-based buffer overflow in ec_read_file_func (unzip.c).

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

2.11%Up 1.1 points since Apr 14, 2021

What each source reports

NVD Score used 8.8

GNU Libextractor before 1.7 has a stack-based buffer overflow in ec_read_file_func (unzip.c).

Record: CVE-2018-14346
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-787
Updated: 2026-11-02

CVE List No score

GNU Libextractor before 1.7 has a stack-based buffer overflow in ec_read_file_func (unzip.c).

Record: CVE-2018-14346
Updated: 2026-11-02

EUVDEUVD-2018-6267 No score

GNU Libextractor before 1.7 has a stack-based buffer overflow in ec_read_file_func (unzip.c).

Record: EUVD-2018-6267
Updated: 2026-11-03

GitHub AdvisoriesGHSA-gfcm-4735-4cv3 8.8

GNU Libextractor before 1.7 has a stack-based buffer overflow in ec_read_file_func (unzip.c).

GNU Libextractor before 1.7 has a stack-based buffer overflow in ec_read_file_func (unzip.c).

Record: GHSA-gfcm-4735-4cv3
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-787
Updated: 2026-11-02

OSV 8.8

GNU Libextractor before 1.7 has a stack-based buffer overflow in ec_read_file_func (unzip.c).

Record: CVE-2018-14346
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2018-14346 8.8

GNU Libextractor before 1.7 has a stack-based buffer overflow in ec_read_file_func (unzip.c).

Record: DEBIAN-CVE-2018-14346
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2018-14346 8.8

GNU Libextractor before 1.7 has a stack-based buffer overflow in ec_read_file_func (unzip.c).

Record: UBUNTU-CVE-2018-14346
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVMGASA-2018-0388 No score

Updated libextratcor packages fix security vulnerability

Several vulnerabilities were discovered in libextractor which may lead to denial of service or the execution of arbitrary code if a specially crafted file is opened (CVE-2018-14346, CVE-2018-14347, CVE-2018-16430).

Record: MGASA-2018-0388
Updated: 2026-11-02

OSVUSN-4641-1 No score

libextractor vulnerabilities

It was discovered that Libextractor incorrectly handled zero sample rate. An attacker could possibly use this issue to cause a denial of service. (CVE-2017-15266)

It was discovered that Libextractor incorrectly handled certain FLAC metadata. An attacker could possibly use this issue to cause a denial of service. (CVE-2017-15267)

It was discovered that Libextractor incorrectly handled certain specially crafted files. An attacker could possibly use this issue to cause a denial of service. (CVE-2017-15600, CVE-2018-16430, CVE-2018-20430)

It was discovered that Libextractor incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service. (CVE-2017-15601)

It was discovered that Libextractor incorrectly handled integers. An attacker could possibly use this issue to cause a denial of service. (CVE-2017-15602)

It was discovered that Libextractore incorrectly handled certain crafted files. An attacker could possibly use this issue to cause a denial of service. (CVE-2017-15922)

It was discovered tha Libextractor incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service. (CVE-2017-17440)

It was discovered that Libextractor incorrectly handled certain malformed files. An attacker could possibly use this issue to cause a denial of service. (CVE-2018-14346)

It was discovered that Libextractor incorrectly handled malformed files. An attacker could possibly use this issue to cause a denial of service. (CVE-2018-14347)

It was discovered that Libextractor incorrectly handled metadata. An attacker could possibly use this issue to cause a denial of service. (CVE-2018-20431)

Record: USN-4641-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`libextractor` Debian:12	before 1:1.7-1	1:1.7-1
`libextractor` Debian:13	before 1:1.7-1	1:1.7-1
`libextractor` Debian:14	before 1:1.7-1	1:1.7-1
`libextractor` Debian:8	before 1:1.3-2+deb8u2, plus listed versions 1:1.3-21:1.3-2+deb8u1	1:1.3-2+deb8u2
`libextractor` Debian:9	before 1:1.3-4+deb9u2, plus listed versions 1:1.3-41:1.3-4+deb9u1	1:1.3-4+deb9u2
`libextractor` Mageia:6	before 1.7-1.mga6	1.7-1.mga6
`libextractor` Ubuntu:Pro:14.04:LTS	before 1:1.3-1ubuntu0.1~esm1, plus listed versions 1:1.1-1ubuntu11:1.2-1ubuntu11:1.3-1	1:1.3-1ubuntu0.1~esm1
`libextractor` Ubuntu:16.04:LTS	before 1:1.3-4+deb9u3build0.16.04.1, plus listed versions 1:1.3-2build11:1.3-2ubuntu11:1.3-3	1:1.3-4+deb9u3build0.16.04.1
`libextractor` Ubuntu:18.04:LTS	All versions, plus listed versions 1:1.3-4build31:1.6-11:1.6-1build11:1.6-2	None known

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 17 moreShow less