CVE-2018-25242

One Search 1.1.0.0 Denial of Service

Published Apr 4, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Description

One Search 1.1.0.0 contains a denial of service vulnerability that allows local attackers to crash the application by submitting excessively long input strings to the search functionality. Attackers can paste a buffer of 950 or more characters into the search bar to trigger an unhandled exception that crashes the application.

Analysis

Technical impact

The vulnerability occurs when the OneSearch search feature receives an input string of 950 or more characters. The long string triggers an unhandled exception, leading to the application terminating unexpectedly. As a result, the software becomes unavailable to users until it is restarted, causing a local denial of service. The weakness corresponds to improper input validation and is identified as CWE-1389.

Affected Systems

The issue affects the OneSearch application version 1.1.0.0. It is distributed as One Search by the vendor OneSearch. Only installations of this specific release are susceptible; newer or older versions are not listed as affected.

Risk and Exploitability

The vulnerability has a CVSS score of 6.9, indicating a moderate severity. No EPSS score is available, and the vulnerability is not included in the CISA KEV catalog, suggesting it is not currently known to be exploited in the wild. The attack requires local access to the machine running the application and the ability to submit a search query, meaning it is limited to privileged users or those who have authenticated locally. Exploitation does not require remote network exposure but could be amplified in environments where the application is exposed to many local users.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

OneSearch

One Search

affected

Version	Status	Constraints
`1.1.0.0`	affected	—

No data.

Vendor Product Versions

Microsoft

One Search

Version	Status	Scheme	Platform
`1.1.0.0`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update OneSearch to a patched version if available from the vendor.
Restrict local access to the application by applying firewall rules or network segmentation.
Monitor application logs for unusually long search strings and investigate anomalies.

Generated by OpenCVE AI on April 4, 2026 at 18:21 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.174% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://www.exploit-db.com/exploits/46195
https://www.microsoft.com/store/productId/9PMR5QNS5LTL
https://www.vulncheck.com/advisories/one-search-denial-of-service

History

Apr 7, 2026 12:00 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Microsoft Microsoft one Search
Vendors & Products		Microsoft Microsoft one Search

Apr 6, 2026 2:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 4, 2026 9:15 PM References updated View changes

Type	Values Removed	Values Added
References	https://www.vulncheck.com/advisories/microsoft-one-search-denial-of-service	https://www.vulncheck.com/advisories/one-search-denial-of-service

Apr 4, 2026 4:15 PM Description updated. Title updated View changes

Type	Values Removed	Values Added
Description	Microsoft One Search 1.1.0.0 contains a denial of service vulnerability that allows local attackers to crash the application by submitting excessively long input strings to the search functionality. Attackers can paste a buffer of 950 or more characters into the search bar to trigger an unhandled exception that crashes the application.	One Search 1.1.0.0 contains a denial of service vulnerability that allows local attackers to crash the application by submitting excessively long input strings to the search functionality. Attackers can paste a buffer of 950 or more characters into the search bar to trigger an unhandled exception that crashes the application.
Title	Microsoft One Search 1.1.0.0 Denial of Service	One Search 1.1.0.0 Denial of Service

Apr 4, 2026 3:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Microsoft One Search 1.1.0.0 contains a denial of service vulnerability that allows local attackers to crash the application by submitting excessively long input strings to the search functionality. Attackers can paste a buffer of 950 or more characters into the search bar to trigger an unhandled exception that crashes the application.
Title		Microsoft One Search 1.1.0.0 Denial of Service
Weaknesses		CWE-1389
References		https://www.exploit-db.com/exploits/46195 https://www.microsoft.com/store/productId/9PMR5QNS5LTL https://www.vulncheck.com/advisories/microsoft-one-search-denial-of-service
Metrics		cvssV3_1 `{'score': 6.2, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`