CVE-2018-11099
The header::add_INFO_descriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers...
The header::add_INFO_descriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers to cause information disclosure (heap-based buffer over-read) via a crafted vcf file.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The header::add_INFO_descriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers to cause information disclosure (heap-based buffer over-read) via a crafted vcf file.
- Record
CVE-2018-11099- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-125
- Updated
- 2026-11-02
CVE List No score
The header::add_INFO_descriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers to cause information disclosure (heap-based buffer over-read) via a crafted vcf file.
- Record
CVE-2018-11099- Updated
- 2026-11-02
EUVDEUVD-2018-3141 No score
The header::add_INFO_descriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers to cause information disclosure (heap-based buffer over-read) via a crafted vcf file.
- Record
EUVD-2018-3141- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v33r-7jqx-q3xh
The header::add_INFO_descriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers...
The header::add_INFO_descriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers to cause information disclosure (heap-based buffer over-read) via a crafted vcf file.
- Record
GHSA-v33r-7jqx-q3xh- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-125
- Updated
- 2026-11-02
OSV
The header::add_INFO_descriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers to cause information disclosure (heap-based buffer over-read) via a crafted vcf file.
- Record
CVE-2018-11099- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-11099
The header::add_INFO_descriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers to cause information disclosure (heap-based buffer over-read) via a crafted vcf file.
- Record
DEBIAN-CVE-2018-11099- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-11099
The header::add_INFO_descriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers to cause information disclosure (heap-based buffer over-read) via a crafted vcf file.
- Record
UBUNTU-CVE-2018-11099- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUSN-3974-1 No score
VCFtools vulnerabilities
It was discovered that VCFtools improperly handled certain input. If a user was tricked into opening a crafted input file, VCFtools could be made to crash. (CVE-2018-11099, CVE-2018-11129, CVE-2018-11130)
- Record
USN-3974-1- Updated
- 2026-11-02
OSVUSN-4835-1 No score
vcftools vulnerabilities
It was discovered that VCFtools improperly handled certain input. If a user were tricked into opening a crafted input file, VCFtools could be made to crash or possibly cause other unspecified impact. (CVE-2018-11099, CVE-2018-11129, CVE-2018-11130)
It was discovered that VCFtools improperly handled memory allocation/deallocation, resulting in a use-after-free vulnerability. If a victim were tricked into opening a specially crafted VCF File, an attacker could cause VCFtools to leak sensitive information or possibly execute arbitrary code. (CVE-2019-1010127)
- Record
USN-4835-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
vcftoolsDebian:12 |
before 0.1.16-1 | 0.1.16-1 |
vcftoolsDebian:13 |
before 0.1.16-1 | 0.1.16-1 |
vcftoolsDebian:14 |
before 0.1.16-1 | 0.1.16-1 |
vcftoolsDebian:8 |
before 0.1.12+dfsg-1+deb8u1, plus listed versions 0.1.12+dfsg-1 |
0.1.12+dfsg-1+deb8u1 |
vcftoolsUbuntu:Pro:14.04:LTS |
before 0.1.11+dfsg-1ubuntu0.1~esm1, plus listed versions 0.1.11+dfsg-1 |
0.1.11+dfsg-1ubuntu0.1~esm1 |
vcftoolsUbuntu:16.04:LTS |
before 0.1.14+dfsg-2ubuntu0.1, plus listed versions 0.1.13+dfsg-10.1.14+dfsg-10.1.14+dfsg-2 |
0.1.14+dfsg-2ubuntu0.1 |
vcftoolsUbuntu:Pro:18.04:LTS |
before 0.1.15-1ubuntu0.1~esm1, plus listed versions 0.1.14+dfsg-40.1.15-1 |
0.1.15-1ubuntu0.1~esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-11099 is a medium vulnerability (CVSS 5.5) in Vcftools Project Vcftools, published May 17, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.47%, the 73rd percentile. Fixed in vcftools 0.1.16-1.