CVE-2018-25294

8.7 highEPSS 0.4%

CEWE Photoshow 6.3.4 contains a buffer overflow vulnerability in the login dialog that allows attackers to crash the application by submitting oversized input. Attackers can inject 4000 bytes of data into the email address and password fields to trigger a denial of service condition.

Severity

CVSS 4.0

8.7 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 32% of CVEs (scores of 2026-10-31)
CWE: CWE-120
Published: 2026-04-26
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://cewe-photoworld.com/
https://cewe-photoworld.com/creator-software/windows-download
https://www.exploit-db.com/exploits/45211
https://www.vulncheck.com/advisories/cewe-photoshow-buffer-overflow-denial-of-service

Check your stack JSON