Every CVE Search/ Get API key

CVE-2018-18586

** DISPUTED ** chmextract.c in the chmextract sample program, as distributed with libmspack...

5.3 MediumFix availableDisputed

chmextract.c in the chmextract sample program, as distributed with libmspack before 0.8alpha, does not protect against absolute/relative pathnames in CHM files, leading to Directory Traversal. NOTE: the vendor disputes that this is a libmspack vulnerability, because chmextract.c was only intended as a source-code example, not a supported application

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

3.28%Up 2.2 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 5.3

chmextract.c in the chmextract sample program, as distributed with libmspack before 0.8alpha, does not protect against absolute/relative pathnames in CHM files, leading to Directory Traversal. NOTE: the vendor disputes that this is a libmspack vulnerability, because chmextract.c was only intended as a source-code example, not a supported application

Record
CVE-2018-18586
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness
CWE-22
Updated
2026-11-02
CVE List No score

chmextract.c in the chmextract sample program, as distributed with libmspack before 0.8alpha, does not protect against absolute/relative pathnames in CHM files, leading to Directory Traversal. NOTE: the vendor disputes that this is a libmspack vulnerability, because chmextract.c was only intended as a source-code example, not a supported application

Record
CVE-2018-18586
Updated
2026-11-02
EUVDEUVD-2018-10306 No score

chmextract.c in the chmextract sample program, as distributed with libmspack before 0.8alpha, does not protect against absolute/relative pathnames in CHM files, leading to Directory Traversal. NOTE: the vendor disputes that this is a libmspack vulnerability, because chmextract.c was only intended as a source-code example, not a supported application

Record
EUVD-2018-10306
Updated
2026-11-03
GitHub AdvisoriesGHSA-jcvf-2rhc-m6h8 5.3

** DISPUTED ** chmextract.c in the chmextract sample program, as distributed with libmspack...

** DISPUTED ** chmextract.c in the chmextract sample program, as distributed with libmspack before 0.8alpha, does not protect against absolute/relative pathnames in CHM files, leading to Directory Traversal. NOTE: the vendor disputes that this is a libmspack vulnerability, because chmextract.c was only intended as a source-code example, not a supported application.

Record
GHSA-jcvf-2rhc-m6h8
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-22
Updated
2026-11-02
OSVALPINE-CVE-2018-18586 5.3

chmextract.c in the chmextract sample program, as distributed with libmspack before 0.8alpha, does not protect against absolute/relative pathnames in CHM files, leading to Directory Traversal. NOTE: the vendor disputes that this is a libmspack vulnerability, because chmextract.c was only intended as a source-code example, not a supported application

Record
ALPINE-CVE-2018-18586
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSV 5.3

chmextract.c in the chmextract sample program, as distributed with libmspack before 0.8alpha, does not protect against absolute/relative pathnames in CHM files, leading to Directory Traversal. NOTE: the vendor disputes that this is a libmspack vulnerability, because chmextract.c was only intended as a source-code example, not a supported application

Record
CVE-2018-18586
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
Show 7 moreShow less
OSVDEBIAN-CVE-2018-18586 5.3

chmextract.c in the chmextract sample program, as distributed with libmspack before 0.8alpha, does not protect against absolute/relative pathnames in CHM files, leading to Directory Traversal. NOTE: the vendor disputes that this is a libmspack vulnerability, because chmextract.c was only intended as a source-code example, not a supported application

Record
DEBIAN-CVE-2018-18586
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVMGASA-2018-0455 No score

Updated libmspack/cabextract packages fix security vulnerabilities

Hanno Böck discovered that libmspack incorrectly handled certain CHM files. An attacker could possibly use this issue to cause a denial of service (CVE-2018-14679, CVE-2018-14680).

Jakub Wilk discovered that libmspack incorrectly handled certain KWAJ files. An attacker could possibly use this issue to execute arbitrary code (CVE-2018-14681).

Dmitry Glavatskikh discovered that libmspack incorrectly certain CHM files. An attacker could possibly use this issue to execute arbitrary code (CVE-2018-14682).

If a CAB file has a Quantum-compressed datablock with exactly 38912 compressed bytes, cabextract would write exactly one byte beyond its input buffer (CVE-2018-18584).

libmspack didn't reject blank CHM filenames that are blank because they have embedded null bytes, not just because they are zero-length (CVE-2018-18585).

chmextract didn't protect from absolute/relative pathnames in CHM files (CVE-2018-18586).

Record
MGASA-2018-0455
Updated
2026-11-02
OSVopenSUSE-SU-2022:0069-1 No score

Security update for libmspack

This update for libmspack fixes the following issues:

  • CVE-2018-18586: Fixed directory traversal in chmextract by adding anti '../' and leading slash protection (bsc#1113040).
Record
openSUSE-SU-2022:0069-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:13619-1 No score

libmspack-devel-0.11-2.1 on GA media

These are all security issues fixed in the libmspack-devel-0.11-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13619-1
Updated
2026-11-02
OSVSUSE-SU-2022:0069-1 No score

Security update for libmspack

This update for libmspack fixes the following issues:

  • CVE-2018-18586: Fixed directory traversal in chmextract by adding anti '../' and leading slash protection (bsc#1113040).
Record
SUSE-SU-2022:0069-1
Updated
2026-11-02
OSVSUSE-SU-2022:0069-2 No score

Security update for libmspack

This update for libmspack fixes the following issues:

  • CVE-2018-18586: Fixed directory traversal in chmextract by adding anti '../' and leading slash protection (bsc#1113040).
Record
SUSE-SU-2022:0069-2
Updated
2026-11-02
OSVSUSE-SU-2022:4287-1 No score

Security update for libmspack

This update for libmspack fixes the following issues:

  • CVE-2018-18586: Add leading slash protection to chmextract. (bsc#1113040)
Record
SUSE-SU-2022:4287-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libmspack
Alpine:v3.10
 before 0.8_alpha-r0
0.8_alpha-r0
libmspack
Alpine:v3.11
 before 0.8_alpha-r0
0.8_alpha-r0
libmspack
Alpine:v3.6
 before 0.8_alpha-r0
0.8_alpha-r0
libmspack
Alpine:v3.7
 before 0.8_alpha-r0
0.8_alpha-r0
libmspack
Alpine:v3.8
 before 0.8_alpha-r0
0.8_alpha-r0
libmspack
Alpine:v3.9
 before 0.8_alpha-r0
0.8_alpha-r0
libmspack
Debian:12
 before 0.8-1
0.8-1
libmspack
Debian:13
 before 0.8-1
0.8-1
libmspack
Debian:14
 before 0.8-1
0.8-1
libmspack
Mageia:6
 before 0.9.1-0.alpha.1.mga6
0.9.1-0.alpha.1.mga6
Show 9 moreShow less
Affected packages
PackageAffectedFixed
cabextract
Mageia:6
 before 1.9-1.mga6
1.9-1.mga6
libmspack
SUSE:Linux Enterprise Module for Basesystem 15 SP3
 before 0.6-3.14.1
0.6-3.14.1
libmspack
SUSE:Linux Enterprise Micro 5.0
 before 0.6-3.14.1
0.6-3.14.1
libmspack
SUSE:Linux Enterprise Micro 5.1
 before 0.6-3.14.1
0.6-3.14.1
libmspack
SUSE:Linux Enterprise Real Time 15 SP2
 before 0.6-3.14.1
0.6-3.14.1
libmspack
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 0.4-15.13.1
0.4-15.13.1
libmspack
SUSE:Linux Enterprise Server 12 SP5
 before 0.4-15.13.1
0.4-15.13.1
libmspack
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 0.4-15.13.1
0.4-15.13.1
libmspack
openSUSE:Leap 15.3
 before 0.6-3.14.1
0.6-3.14.1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-18586 is a medium vulnerability (CVSS 5.3) in Kyzer Libmspack, published October 23, 2018. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 3.28%, the 88th percentile. Fixed in libmspack 0.8_alpha-r0.

References

Show 15 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open