CVE-2018-25267

UltraISO 9.7.1.3519 Buffer Overflow via Output FileName

Published Apr 22, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Description

UltraISO 9.7.1.3519 contains a local buffer overflow vulnerability in the Output FileName field of the Make CD/DVD Image dialog that allows attackers to overwrite SEH and SE handler records. Attackers can craft a malicious filename string with 304 bytes of data followed by SEH record overwrite values and paste it into the Output FileName field to trigger a denial of service crash.

Analysis

Technical impact

UltraISO 9.7.1.3519 contains a local buffer overflow in the Output FileName field of the Make CD/DVD Image dialog; attackers can craft a 304‑byte string to overwrite Structured Exception Handler (SEH) records and cause a crash. The vulnerability allows an adversary to trigger a denial of service by simply pasting the malicious string into the dialog, without executing arbitrary code, but the denial of service can be leveraged to disrupt system availability.

Affected Systems

The affected product is UltraISO version 9.7.1.3519 for Windows; earlier version 9.35 is also listed but the specific vulnerability is reported for 9.7.1.3519. Users running this version on any Windows operating system are at risk.

Risk and Exploitability

The CVSS score of 6.9 indicates a medium severity; the EPSS score is not available, so the exploitation probability cannot be quantified, and the issue is not listed in CISA’s KEV catalog, implying no known active exploitation. The vulnerability is local, requiring an attacker to interact with the user interface or supply a crafted filename on the machine, so it is unlikely to be exploited remotely without user cooperation. Nevertheless, because it causes a crash that can affect critical processes, it should be treated as a significant risk to system availability.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Ultraiso

UltraISO

affected

Version	Status	Constraints
`9.7.1.3519`	affected	—

Configuration 1 [-]

cpe:2.3:a:ezbsystems:ultraiso:9.7.1.3519:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Ultraiso

Version	Status	Scheme	Platform
`9.7.1.3519`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest UltraISO patch that includes bounds checking for the Output FileName field.
Enable or enforce input validation in the application to reject filenames exceeding the allowed buffer size (e.g., 248 bytes), mitigating CWE‑787 overflows.
If patching is not possible, limit the use of the Make CD/DVD Image dialog to trusted users or disable the feature altogether to reduce exposure.

Generated by OpenCVE AI on April 27, 2026 at 08:51 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.181% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://www.exploit-db.com/exploits/45996
https://www.ultraiso.com/
https://www.vulncheck.com/advisories/ultraiso-buffer-overflow-via-output-filename

History

Apr 29, 2026 11:30 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Ezbsystems Ezbsystems ultraiso
CPEs		cpe:2.3:a:ezbsystems:ultraiso:9.7.1.3519:::::::*
Vendors & Products		Ezbsystems Ezbsystems ultraiso

Apr 23, 2026 2:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 22, 2026 3:30 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		UltraISO 9.7.1.3519 contains a local buffer overflow vulnerability in the Output FileName field of the Make CD/DVD Image dialog that allows attackers to overwrite SEH and SE handler records. Attackers can craft a malicious filename string with 304 bytes of data followed by SEH record overwrite values and paste it into the Output FileName field to trigger a denial of service crash.
Title		UltraISO 9.7.1.3519 Buffer Overflow via Output FileName
First Time appeared		Ultraiso Ultraiso ultraiso
Weaknesses		CWE-787
CPEs		cpe:2.3:a:ultraiso:ultraiso:9.35::::premium::: cpe:2.3:a:ultraiso:ultraiso:9.7.1.3519:::::::*
Vendors & Products		Ultraiso Ultraiso ultraiso
References		https://www.exploit-db.com/exploits/45996 https://www.ultraiso.com/ https://www.vulncheck.com/advisories/ultraiso-buffer-overflow-via-output-filename
Metrics		cvssV3_1 `{'score': 6.2, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`