CVE-2018-17909 Use after free in CX-Supervisor

High 7.8 Published 5 Nov 2018 Updated 16 Sep 2024

An attacker can execute arbitrary code by exploiting a use-after-free vulnerability in Omron CX-Supervisor when processing malicious project files.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2018-17909?

CVE-2018-17909 is a high-severity use after free vulnerability in Omron CX-Supervisor, published on 5 Nov 2018. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

When processing project files in Omron CX-Supervisor Versions 3.4.1.0 and prior, the application fails to check if it is referencing freed memory, which may allow an attacker to execute code under the context of the application.

Weakness: CWE-416

Which versions are affected by CVE-2018-17909?

It affects 1 product.

Products include Omron Cx-Supervisor.

How do I fix CVE-2018-17909?

No fix has been published for CVE-2018-17909 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2018-17909 being exploited?

There is no known exploitation of CVE-2018-17909 in the wild and no public exploit code.

Sources

Also known as GHSA-5j3q-fm57-p88f.