CVE-2018-11498

HIGH 7.8CVE-2018-11498 · Published 26/05/2018 · updated 17/06/2026

In short

CVE-2018-11498 is a HIGH (CVSS 7.8) vulnerability affecting lizard (lizard project), lz5 (lizard project).
Chance of exploitation in the next 30 days (EPSS): 1.9%, higher than 80.3% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
lizard lizard_project	`= 1.0`	No fix yet
lz5 lizard_project	`= 2.0`	No fix yet

Description

In Lizard v1.0 and LZ5 v2.0 (the prior release, before the product was renamed), there is an unchecked buffer size during a memcpy in the Lizard_decompress_LIZv1 function (lib/lizard_decompress_liz.h). Remote attackers can leverage this vulnerability to cause a denial of service via a crafted input file, as well as achieve remote code execution.

References

inikep/lizard · Third Party Advisory

More vulnerabilities in lizard

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free