CVE-2018-1000178

9.8 criticalEPSS 4.1%

Critical (9.8). EPSS 4.1% chance of exploitation in the next 30 days.

A heap corruption of type CWE-120 exists in quassel version 0.12.4 in quasselcore in void DataStreamPeer::processMessage(const QByteArray &msg) datastreampeer.cpp line 62 that allows an attacker to execute code remotely.

Severity

CVSS 3.0

9.8 critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 4.1% chance of exploitation in the next 30 days; higher than 90% of CVEs (scores of 2026-10-31)
CWE: CWE-787
Published: 2018-05-08
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

debian:debian_linux
quassel-irc:quassel

References

https://github.com/quassel/quassel/blob/master/src/common/protocols/datastream/datastreampeer.cpp#L62
https://i.imgur.com/JJ4QcNq.png
https://lists.debian.org/debian-lts-announce/2018/05/msg00001.html
https://security.gentoo.org/glsa/201806-04
https://usn.ubuntu.com/4594-1/

Check your stack JSON