{"id":"CVE-2018-5410","aliases":["EUVD-2018-17180","GHSA-353c-4p9g-7m63"],"status":"published","title":"Dokan file system driver contains a stack-based buffer overflow","description":"Dokan, versions between 1.0.0.5000 and 1.2.0.1000, are vulnerable to a stack-based buffer overflow in the dokan1.sys driver. An attacker can create a device handle to the system driver and send arbitrary input that will trigger the vulnerability. This vulnerability was introduced in the 1.0.0.5000 version update.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01594,"percentile":0.75881,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-121","CWE-787"],"published":"2019-01-07T13:29:00.28Z","modified":"2026-10-20T10:49:55Z","exploits":[{"source":"exploitdb","id":"EDB-46155","title":"Dokany 1.2.0.1000 - Stack-Based Buffer Overflow Privilege Escalation","type":"local","platform":"windows","date":"2019-01-14","verified":true,"url":"https://www.exploit-db.com/exploits/46155"}],"products":[{"vendor":"dokan","product":"open source file system"},{"vendor":"dokan-dev","product":"dokany"}],"references":[{"url":"https://kb.cert.org/vuls/id/741315/","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred","Third Party Advisory","US Government Resource","advisory"]},{"url":"https://www.exploit-db.com/exploits/46155/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://cwe.mitre.org/data/definitions/121.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/dokan-dev/dokany/releases/tag/v1.2.1.1000","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"http://www.securityfocus.com/bid/106274","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-5410"},{"url":"https://kb.cert.org/vuls/id/741315"},{"url":"https://www.exploit-db.com/exploits/46155"},{"url":"https://github.com/advisories/GHSA-353c-4p9g-7m63"}],"sources":{"cve":[{"id":"CVE-2018-5410","title":"Dokan file system driver contains a stack-based buffer overflow","description":"Dokan, versions between 1.0.0.5000 and 1.2.0.1000, are vulnerable to a stack-based buffer overflow in the dokan1.sys driver. An attacker can create a device handle to the system driver and send arbitrary input that will trigger the vulnerability. This vulnerability was introduced in the 1.0.0.5000 version update.","status":"published","published":"2019-01-07T14:00:00Z","modified":"2024-08-05T05:33:44.211Z","cwes":["CWE-121"],"updated_at":"2026-11-02T14:35:01.28843Z"}],"euvd":[{"id":"EUVD-2018-17180","description":"Dokan, versions between 1.0.0.5000 and 1.2.0.1000, are vulnerable to a stack-based buffer overflow in the dokan1.sys driver. An attacker can create a device handle to the system driver and send arbitrary input that will trigger the vulnerability. This vulnerability was introduced in the 1.0.0.5000 version update.","status":"published","published":"2019-01-07T14:00:00Z","modified":"2024-08-05T05:33:44Z","updated_at":"2026-11-03T02:40:10.651692Z"}],"ghsa":[{"id":"GHSA-353c-4p9g-7m63","title":"Dokan, versions between 1.0.0.5000 and 1.2.0.1000, are vulnerable to a stack-based buffer...","description":"Dokan, versions between 1.0.0.5000 and 1.2.0.1000, are vulnerable to a stack-based buffer overflow in the dokan1.sys driver. An attacker can create a device handle to the system driver and send arbitrary input that will trigger the vulnerability. This vulnerability was introduced in the 1.0.0.5000 version update.","status":"published","published":"2022-05-13T01:16:11Z","modified":"2026-02-25T15:32:38Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-121","CWE-787"],"updated_at":"2026-11-02T15:06:22.176933Z"}],"nvd":[{"id":"CVE-2018-5410","description":"Dokan, versions between 1.0.0.5000 and 1.2.0.1000, are vulnerable to a stack-based buffer overflow in the dokan1.sys driver. An attacker can create a device handle to the system driver and send arbitrary input that will trigger the vulnerability. This vulnerability was introduced in the 1.0.0.5000 version update.","status":"published","published":"2019-01-07T13:29:00.28Z","modified":"2026-06-17T02:00:16.927Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-121","CWE-787"],"updated_at":"2026-11-02T14:04:52.056758Z"}],"osv":[{"id":"CVE-2018-5410","description":"Dokan, versions between 1.0.0.5000 and 1.2.0.1000, are vulnerable to a stack-based buffer overflow in the dokan1.sys driver. An attacker can create a device handle to the system driver and send arbitrary input that will trigger the vulnerability. This vulnerability was introduced in the 1.0.0.5000 version update.","status":"published","published":"2019-01-07T13:29:00.28Z","modified":"2026-10-20T10:49:55.302572149Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:09.442568Z"}]}}