CVE-2018-3971

HIGH 7.8CVE-2018-3971 · Published 25/10/2018 · updated 17/06/2026

In short

CVE-2018-3971 is a HIGH (CVSS 7.8) vulnerability affecting hitmanpro.alert (sophos).
Chance of exploitation in the next 30 days (EPSS): 0.54%, higher than 45.5% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
hitmanpro.alert sophos	`= 3.7.6.744`	No fix yet

Description

An exploitable arbitrary write vulnerability exists in the 0x2222CC IOCTL handler functionality of Sophos HitmanPro.Alert 3.7.6.744. A specially crafted IRP request can cause the driver to write data under controlled by an attacker address, resulting in memory corruption. An attacker can send IRP request to trigger this vulnerability.

References

securityfocus.com/bid/105743 · Broken Link
talosintelligence.com/vulnerability_reports/TALOS-2018-0636 · Exploit

More vulnerabilities in hitmanpro.alert

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free