CVE-2018-6641 Use after free in n/a

Critical 9.8 Published 28 Feb 2018 Updated 5 Aug 2024

Crafted input in MathType triggers a use-after-free, allowing remote attackers to execute arbitrary code via invalid function pointer calls.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2018-6641?

CVE-2018-6641 is a critical use after free vulnerability in n/a, published on 28 Feb 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An Arbitrary Free (Remote Code Execution) issue was discovered in Design Science MathType 6.9c. Crafted input can overwrite a structure, leading to a function call with an invalid parameter, and a subsequent free of important data such as a function pointer or list pointer. This is fixed in 6.9d.

Weakness: CWE-416

Which versions are affected by CVE-2018-6641?

It affects 1 product.

Products include Wiris Mathtype.

How do I fix CVE-2018-6641?

No fix has been published for CVE-2018-6641 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2018-6641 being exploited?

There is no known exploitation of CVE-2018-6641 in the wild and no public exploit code.

Sources

Also known as GHSA-p4xx-95p7-3998.