9.8crit
CVE-2016-20049
JAD 1.5.8e-1kali1 Stack-Based Buffer Overflow Remote Code Execution
Published 7 mo ago · modified 4 mo ago · JSON
CVSS
9.8
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.7%
percentile 53%
Public exploits
0
none known
Summary
JAD 1.5.8e-1kali1 and prior contains a stack-based buffer overflow vulnerability that allows attackers to execute arbitrary code by supplying oversized input that exceeds buffer boundaries. Attackers can craft malicious input strings exceeding 8150 bytes to overflow the stack, overwrite return addresses, and execute shellcode in the application context.
CISA SSVC assessment
- Exploitation
- Proof of concept public
- Automatable
- yes
- Technical impact
- total
- Assessed
- 7 mo ago
Exploit prediction (EPSS)
0.68% probability of exploitation in the next 30 days, higher than 53% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 4.0 | 9.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 4.0 | 9.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
- Varaneckas JAD Java Decompiler
Classification
- Weakness
- CWE-787 Out-of-bounds Write
References
- exploit-db.com /exploits/42076 · exploit
- varaneckas.com /jad/ · product
- vulncheck.com /advisories/jad-8e-1kali1-stack-based-buffer-overflow-remote-code-execution · third-party-advisory
Sources
- CVE List: CVE-2016-20049
- NVD: CVE-2016-20049
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.