CVE-2018-10196
NULL pointer dereference vulnerability in the rebuild_vlists function in lib/dotgen/conc.c in the...
NULL pointer dereference vulnerability in the rebuild_vlists function in lib/dotgen/conc.c in the dotgen library in Graphviz 2.40.1 allows remote attackers to cause a denial of service (application crash) via a crafted file.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
NULL pointer dereference vulnerability in the rebuild_vlists function in lib/dotgen/conc.c in the dotgen library in Graphviz 2.40.1 allows remote attackers to cause a denial of service (application crash) via a crafted file.
- Record
CVE-2018-10196- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-476
- Updated
- 2026-11-02
CVE List No score
NULL pointer dereference vulnerability in the rebuild_vlists function in lib/dotgen/conc.c in the dotgen library in Graphviz 2.40.1 allows remote attackers to cause a denial of service (application crash) via a crafted file.
- Record
CVE-2018-10196- Updated
- 2026-11-02
EUVDEUVD-2018-2272 No score
NULL pointer dereference vulnerability in the rebuild_vlists function in lib/dotgen/conc.c in the dotgen library in Graphviz 2.40.1 allows remote attackers to cause a denial of service (application crash) via a crafted file.
- Record
EUVD-2018-2272- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9jm3-9x6p-8q48
NULL pointer dereference vulnerability in the rebuild_vlists function in lib/dotgen/conc.c in the...
NULL pointer dereference vulnerability in the rebuild_vlists function in lib/dotgen/conc.c in the dotgen library in Graphviz 2.40.1 allows remote attackers to cause a denial of service (application crash) via a crafted file.
- Record
GHSA-9jm3-9x6p-8q48- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
OSVBELL-CVE-2018-10196
CVE-2018-10196 does not affect BellSoft software
- Record
BELL-CVE-2018-10196- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
NULL pointer dereference vulnerability in the rebuild_vlists function in lib/dotgen/conc.c in the dotgen library in Graphviz 2.40.1 allows remote attackers to cause a denial of service (application crash) via a crafted file.
- Record
CVE-2018-10196- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 11 moreShow less
OSVDEBIAN-CVE-2018-10196
NULL pointer dereference vulnerability in the rebuild_vlists function in lib/dotgen/conc.c in the dotgen library in Graphviz 2.40.1 allows remote attackers to cause a denial of service (application crash) via a crafted file.
- Record
DEBIAN-CVE-2018-10196- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-10196
NULL pointer dereference vulnerability in the rebuild_vlists function in lib/dotgen/conc.c in the dotgen library in Graphviz 2.40.1 allows remote attackers to cause a denial of service (application crash) via a crafted file.
- Record
UBUNTU-CVE-2018-10196- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2018-0307 No score
Updated graphviz packages fix security vulnerability
NULL pointer dereference vulnerability in the rebuild_vlists function in lib/dotgen/conc.c in the dotgen library in Graphviz 2.40.1 allows remote attackers to cause a denial of service (application crash) via a crafted file. (CVE-2018-10196)
- Record
MGASA-2018-0307- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:1294-1 No score
Security update for graphviz
This update for graphviz fixes the following issues:
- CVE-2018-10196: Fixed a null dereference in rebuild_vlis (bsc#1093447).
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2020:1294-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:1303-1 No score
Security update for graphviz
This update for graphviz fixes the following issues:
- CVE-2018-10196: Fixed a null dereference in rebuild_vlis (bsc#1093447).
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2020:1303-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10821-1 No score
graphviz-2.48.0-4.2 on GA media
These are all security issues fixed in the graphviz-2.48.0-4.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10821-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:14524-1 No score
Security update for graphviz
This update for graphviz fixes the following issues:
- CVE-2018-10196: Fixed a null dereference in rebuild_vlis (bsc#1093447).
- Record
SUSE-SU-2020:14524-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:2346-1 No score
Security update for graphviz
This update for graphviz fixes the following issues:
- CVE-2018-10196: Fixed a null dereference in rebuild_vlis (bsc#1093447).
- Record
SUSE-SU-2020:2346-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:3090-1 No score
Security update for graphviz
This update for graphviz fixes the following issues:
- CVE-2018-10196: Fixed a null dereference in rebuild_vlis (bsc#1093447).
- Record
SUSE-SU-2020:3090-1- Updated
- 2026-11-02
OSVUSN-5264-1 No score
graphviz vulnerabilities
It was discovered that graphviz contains null pointer dereference vulnerabilities. Exploitation via a specially crafted input file can cause a denial of service. (CVE-2018-10196, CVE-2019-11023)
It was discovered that graphviz contains a buffer overflow vulnerability. Exploitation via a specially crafted input file can cause a denial of service or possibly allow for arbitrary code execution. (CVE-2020-18032)
- Record
USN-5264-1- Updated
- 2026-11-02
OSVUSN-5971-1 No score
graphviz vulnerabilities
It was discovered that graphviz contains null pointer dereference vulnerabilities. Exploitation via a specially crafted input file can cause a denial of service. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-10196)
It was discovered that graphviz contains null pointer dereference vulnerabilities. Exploitation via a specially crafted input file can cause a denial of service. These issues only affected Ubuntu 14.04 ESM and Ubuntu 18.04 LTS. (CVE-2019-11023)
It was discovered that graphviz contains a buffer overflow vulnerability. Exploitation via a specially crafted input file can cause a denial of service or possibly allow for arbitrary code execution. These issues only affected Ubuntu 14.04 ESM, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-18032)
- Record
USN-5971-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
graphvizDebian:12 |
before 2.40.1-6 | 2.40.1-6 |
graphvizDebian:13 |
before 2.40.1-6 | 2.40.1-6 |
graphvizDebian:14 |
before 2.40.1-6 | 2.40.1-6 |
graphvizDebian:9 From an advisory covering 2 CVEs |
before 2.38.0-17+deb9u1, plus listed versions 2.38.0-17 |
2.38.0-17+deb9u1 |
graphvizMageia:5 |
before 2.38.0-10.1.mga5 | 2.38.0-10.1.mga5 |
graphvizMageia:6 |
before 2.38.0-20.1.mga6 | 2.38.0-20.1.mga6 |
graphviz-pluginsSUSE:Linux Enterprise High Availability Extension 11 SP4 |
before 2.20.2-8.3.6 | 2.20.2-8.3.6 |
graphvizSUSE:Linux Enterprise Module for Basesystem 15 SP1 |
before 2.40.1-6.6.4 | 2.40.1-6.6.4 |
graphviz-addonsSUSE:Linux Enterprise Module for Development Tools 15 SP1 |
before 2.40.1-6.6.8 | 2.40.1-6.6.8 |
graphviz-addonsSUSE:Linux Enterprise Module for Server Applications 15 SP1 |
before 2.40.1-6.6.8 | 2.40.1-6.6.8 |
Show 22 moreShow less
| Package | Affected | Fixed |
|---|---|---|
graphviz-addonsSUSE:Linux Enterprise High Availability Extension 15 |
before 2.40.1-6.6.8 | 2.40.1-6.6.8 |
graphviz-addonsSUSE:Linux Enterprise High Availability Extension 15 SP1 |
before 2.40.1-6.6.8 | 2.40.1-6.6.8 |
graphviz-pluginsSUSE:Linux Enterprise High Availability Extension 12 SP3 |
before 2.28.0-29.3.17 | 2.28.0-29.3.17 |
graphviz-pluginsSUSE:Linux Enterprise High Availability Extension 12 SP4 |
before 2.28.0-29.3.17 | 2.28.0-29.3.17 |
graphviz-pluginsSUSE:Linux Enterprise High Availability Extension 12 SP5 |
before 2.28.0-29.3.17 | 2.28.0-29.3.17 |
graphvizSUSE:Linux Enterprise Software Development Kit 12 SP5 |
before 2.28.0-29.3.8 | 2.28.0-29.3.8 |
graphvizSUSE:Linux Enterprise Server 12 SP5 |
before 2.28.0-29.3.8 | 2.28.0-29.3.8 |
graphviz-pluginsSUSE:Linux Enterprise Server 12 SP5 |
before 2.28.0-29.3.17 | 2.28.0-29.3.17 |
graphvizSUSE:Linux Enterprise Server for SAP Applications 12 SP5 |
before 2.28.0-29.3.8 | 2.28.0-29.3.8 |
graphviz-pluginsSUSE:Linux Enterprise Server for SAP Applications 12 SP5 |
before 2.28.0-29.3.17 | 2.28.0-29.3.17 |
graphvizUbuntu:Pro:14.04:LTS |
before 2.36.0-0ubuntu3.2+esm1, plus listed versions 2.26.3-15ubuntu42.34.0-0ubuntu42.34.0-0ubuntu52.36.0-0ubuntu12.36.0-0ubuntu22.36.0-0ubuntu32.36.0-0ubuntu3.12.36.0-0ubuntu3.2 |
2.36.0-0ubuntu3.2+esm1 |
graphvizUbuntu:Pro:16.04:LTS |
before 2.38.0-12ubuntu2.1+esm1, plus listed versions 2.38.0-10build12.38.0-112.38.0-122.38.0-12build12.38.0-12ubuntu12.38.0-12ubuntu22.38.0-12ubuntu2.1 |
2.38.0-12ubuntu2.1+esm1 |
graphvizUbuntu:Pro:18.04:LTS |
before 2.40.1-2ubuntu0.1~esm1, plus listed versions 2.38.0-16ubuntu22.38.0-18ubuntu12.40.1-0ubuntu52.40.1-0ubuntu62.40.1-2 |
2.40.1-2ubuntu0.1~esm1 |
graphvizUbuntu:Pro:16.04:LTS From an advisory covering 3 CVEs |
before 2.38.0-12ubuntu2.1+esm1, plus listed versions 2.38.0-10build12.38.0-112.38.0-122.38.0-12build12.38.0-12ubuntu12.38.0-12ubuntu22.38.0-12ubuntu2.1 |
2.38.0-12ubuntu2.1+esm1 |
graphvizUbuntu:Pro:14.04:LTS From an advisory covering 3 CVEs |
before 2.36.0-0ubuntu3.2+esm1, plus listed versions 2.26.3-15ubuntu42.34.0-0ubuntu42.34.0-0ubuntu52.36.0-0ubuntu12.36.0-0ubuntu22.36.0-0ubuntu32.36.0-0ubuntu3.12.36.0-0ubuntu3.2 |
2.36.0-0ubuntu3.2+esm1 |
graphvizUbuntu:Pro:18.04:LTS From an advisory covering 3 CVEs |
before 2.40.1-2ubuntu0.1~esm1, plus listed versions 2.38.0-16ubuntu22.38.0-18ubuntu12.40.1-0ubuntu52.40.1-0ubuntu62.40.1-2 |
2.40.1-2ubuntu0.1~esm1 |
graphvizUbuntu:Pro:20.04:LTS From an advisory covering 3 CVEs |
before 2.42.2-3ubuntu0.1~esm1, plus listed versions 2.40.1-7build12.40.1-7build22.42.2-32.42.2-3build12.42.2-3build2 |
2.42.2-3ubuntu0.1~esm1 |
graphvizopenSUSE:Leap 15.1 |
before 2.40.1-lp151.6.6.1 | 2.40.1-lp151.6.6.1 |
graphviz-addonsopenSUSE:Leap 15.1 |
before 2.40.1-lp151.6.6.1 | 2.40.1-lp151.6.6.1 |
graphvizopenSUSE:Leap 15.2 |
before 2.40.1-lp152.7.7.1 | 2.40.1-lp152.7.7.1 |
graphviz-addonsopenSUSE:Leap 15.2 |
before 2.40.1-lp152.7.7.1 | 2.40.1-lp152.7.7.1 |
graphvizopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 2.48.0-4.2 | 2.48.0-4.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-10196 is a medium vulnerability (CVSS 5.5) in Graphviz, published May 30, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.66%, the 76th percentile. Fixed in graphviz 2.40.1-6.
References
usn.ubuntu.com/3731-1
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TWUEEJPMS5LAROYJYY6FREOTI6VPN3M4
gitlab.com/graphviz/graphviz/issues/1367
bugzilla.redhat.com/show_bug.cgi?id=1579254
lists.debian.org/debian-lts-announce/2021/05/msg00014.html
Show 23 moreShow less
nvd.nist.gov/vuln/detail/CVE-2018-10196
github.com/advisories/GHSA-9jm3-9x6p-8q48
docs.bell-sw.com/security/cves/CVE-2018-10196
security-tracker.debian.org/tracker/CVE-2018-10196
advisories.mageia.org/MGASA-2018-0307.html
bugs.mageia.org/show_bug.cgi?id=23133
suse.com/support/update/announcement/2020/suse-su-202014524-1
bugzilla.suse.com/1093447
ubuntu.com/security/CVE-2018-10196
cve.org/CVERecord?id=CVE-2018-10196
lists.opensuse.org/archives/list/[email protected]/thread/M3WSSJIPVCEH4C7ZD5LRQ7F647IGTJ3X