CVE-2018-4022: Use After Free

Published Oct 26, 2018

Updated

A use-after-free vulnerability exists in the way MKVToolNix MKVINFO v25.0.0 handles the MKV (matroska) file format. A specially crafted MKV file can cause arbitrary code execution in the context of the current user.

Affected Software

1 affected component

MKVToolNix MKVINFO=25.0.0

Event History

Oct 26, 2018

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to do to exploit this issue?

An attacker needs to provide a specially crafted MKV (Matroska) file and have a user process it with the affected MKVINFO application. The CVSS vector indicates local attack access and required user interaction, with no privileges required.

What level of access could successful exploitation provide?

Successful exploitation can result in arbitrary code execution in the context of the current user. Confidentiality, integrity, and availability impacts are all rated high in the provided CVSS vector.

CVE-2018-4022: Use After Free

Affected Software

Event History

Frequently Asked Questions

What does an attacker need to do to exploit this issue?

What level of access could successful exploitation provide?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to do to exploit this issue?

What level of access could successful exploitation provide?