CVE-2018-11498 - CVE House
Back to Database
Status published High CVE-2018-11498

In Lizard v1.0 and LZ5 v2.0 (the prior release, before...

Vulnerability Description

In Lizard v1.0 and LZ5 v2.0 (the prior release, before the product was renamed), there is an unchecked buffer size during a memcpy in the Lizard_decompress_LIZv1 function (lib/lizard_decompress_liz.h). Remote attackers can leverage this vulnerability to cause a denial of service via a crafted input file, as well as achieve remote code execution.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-11498

Credits & Attribution

No credits recorded in the NVD database.

References

More from lizard project

View All →
CVE-2018-16985
In Lizard (formerly LZ5) 2.0, use of an invalid memory...
High 7.5

Affected Vendor

lizard project

View all reports →

Affected Software

lizard, lz5
Vulnerable Versions:
1.0, 2.0

Timeline

Official Publish: May 26th, 2018
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.