Vulnerability Description
An exploitable uninitialized pointer vulnerability exists in the Office Open XML parser of Atlantis Word Processor, version 3.2.5.0. A specially crafted document can cause an uninitialized pointer representing a TTableRow to be assigned to a variable on the stack. This variable is later dereferenced and then written to allow for controlled heap corruption, which can lead to code execution under the context of the application. An attacker must convince a victim to open a document in order to trigger this vulnerability.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Atlantiswordprocessor | Atlantis Word Processor | 3.2.5 |
Related Weaknesses (CWE)
References
- https://talosintelligence.com/vulnerability_reports/TALOS-2018-0669ExploitTechnical DescriptionThird Party Advisory
- https://talosintelligence.com/vulnerability_reports/TALOS-2018-0669ExploitTechnical DescriptionThird Party Advisory
FAQ
What is CVE-2018-4001?
CVE-2018-4001 is a vulnerability with a CVSS score of 7.8 (HIGH). An exploitable uninitialized pointer vulnerability exists in the Office Open XML parser of Atlantis Word Processor, version 3.2.5.0. A specially crafted document can cause an uninitialized pointer rep...
How severe is CVE-2018-4001?
CVE-2018-4001 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-4001?
Check the references section above for vendor advisories and patch information. Affected products include: Atlantiswordprocessor Atlantis Word Processor.