GNU Barcode 0.99 Buffer Overflow in Code 93 Encoding Mechanism

Published 10 mo ago 2025-12-24 · modified 4 mo ago 2026-06-17 · JSON

CVSS

9.8

v3.1 · CNA

CISA KEV

not known exploited

EPSS

0.4%

percentile 33%

Public exploits

none known

GNU Barcode 0.99 contains a buffer overflow vulnerability in its code 93 encoding process that allows attackers to trigger memory corruption. Attackers can exploit boundary errors during input file processing to potentially execute arbitrary code on the affected system.

CISA SSVC assessment

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 10 mo ago 2025-12-24

Exploit prediction (EPSS)

0.39% probability of exploitation in the next 30 days, higher than 33% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	4.0	8.5	`CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`
CNA	3.1	9.8	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
CNA	4.0	8.5	`CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
CNA	3.1	9.8	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Affected products

The GNU Project | Free Software Foundation, Inc. GNU Barcode

Classification

Weakness

CWE-787 Out-of-bounds Write

References

exploit-db.com /exploits/44797 · exploit
gnu.org /software/barcode/ · product
directory.fsf.org /wiki/Barcode · product

Sources

CVE List: CVE-2018-25154
NVD: CVE-2018-25154

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary