CVE-2018-8754

** DISPUTED ** The libevt_record_values_read_event() function in libevt_record_values.c in libevt...

5.5 MediumFix availableDisputed

The libevt_record_values_read_event() function in libevt_record_values.c in libevt before 2018-03-17 does not properly check for out-of-bounds values of user SID data size, strings size, or data size. NOTE: the vendor has disputed this as described in libyal/libevt issue 5 on GitHub

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.34%Down 0.3 points since Apr 14, 2021

What each source reports

NVD Score used 5.5

Record: CVE-2018-8754
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0: 2.1 LowAV:L/AC:L/Au:N/C:N/I:N/A:P
Weakness: CWE-125
Updated: 2026-11-02

CVE List No score

Record: CVE-2018-8754
Updated: 2026-11-02

EUVDEUVD-2018-20364 No score

Record: EUVD-2018-20364
Updated: 2026-11-03

GitHub AdvisoriesGHSA-hcvj-rqwj-4h7f 5.5

** DISPUTED ** The libevt_record_values_read_event() function in libevt_record_values.c in libevt...

** DISPUTED ** The libevt_record_values_read_event() function in libevt_record_values.c in libevt before 2018-03-17 does not properly check for out-of-bounds values of user SID data size, strings size, or data size. NOTE: the vendor has disputed this as described in libyal/libevt issue 5 on GitHub.

Record: GHSA-hcvj-rqwj-4h7f
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-125
Updated: 2026-11-02

OSV 5.5

Record: CVE-2018-8754
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2018-8754 5.5

Record: DEBIAN-CVE-2018-8754
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2018-8754 5.5

Record: UBUNTU-CVE-2018-8754
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS 3.0: 6.2 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`libevt` Debian:12	before 20180317-1	20180317-1
`libevt` Debian:13	before 20180317-1	20180317-1
`libevt` Debian:14	before 20180317-1	20180317-1
`libevt` Debian:9	before 20170120-1+deb9u1, plus listed versions 20170120-1	20170120-1+deb9u1
`libevt` Ubuntu:18.04:LTS	before 20170120-2, plus listed versions 20170120-1build1	20170120-2

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-8754 is a medium vulnerability (CVSS 5.5) in Libevt Project Libevt, published March 18, 2018. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. Fixed in libevt 20180317-1.