CVE-2018-1126: Integer Overflow
Last updated 25 August 2025
Other sources
procps-ng before version 3.3.15 is vulnerable to an incorrect integer size in proc/alloc. leading to truncation/integer overflow issues. This flaw is related to CVE-2018-1124.
— Launchpad
procps-ng provides wrappers for standard C allocators that took unsigned int instead of sizet parameters. On platforms where these differ (such as x8664), this could cause integer truncation, leading to undersized regions being returned to callers that could then be overflowed.
This flaw is related to CVE-2018-1124. As stated in the patch provided by Qualys:
> this .. is one of the reasons the integer overflows in file2strvec() are exploitable at all.
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2018-1126?
CVE-2018-1126 is a vulnerability in procps-ng before version 3.3.15 that allows for incorrect integer size leading to truncation/integer overflow issues.
How severe is CVE-2018-1126?
CVE-2018-1126 has a severity rating of 9.8 (Critical).
Which software versions are affected by CVE-2018-1126?
Procps-ng versions before 3.3.15, 3.3.17-5, 4.0.2-3, and 4.0.4-2 are vulnerable to CVE-2018-1126.
How can I fix CVE-2018-1126?
To fix CVE-2018-1126, upgrade procps-ng to version 3.3.15 or later.
Where can I find more information about CVE-2018-1126?
You can find more information about CVE-2018-1126 at the following references: [MITRE CVE-2018-1126](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1126), [Qualys Advisory](https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt), [Ubuntu Security Notice](https://ubuntu.com/security/notices/USN-3658-1).