9.8

CVE-2018-1000517: busybox Classic Buffer Overflow

CVSS: 9.8v3.1CriticalModified
AliasesUBUNTU-CVE-2018-1000517DEBIAN-CVE-2018-1000517
Published 26-06-2018Last modified 09-06-2025
Open JSON

Vulnerability summary

CVE-2018-1000517 is a critical (CVSS 9.8) Classic Buffer Overflow vulnerability in busybox. EPSS estimates a 32.92% chance of exploitation in the next 30 days, higher than 98.3% of scored vulnerabilities.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.8/10
010
Critical · v3.1 (NVD)
EPSS score
32.92%
0%100%
High · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 13 · Related 11
DLA-1445-1DLA-2559-1OPENSUSE-SU-2021:1408-1OPENSUSE-SU-2021:3531-1OPENSUSE-SU-2022:0135-1OPENSUSE-SU-2024:11738-1

Timeline

  1. 26-06-2018
    PublishedVulnerability first disclosed.
  2. 09-06-2025
    Last modifiedVulnerability information updated.

Description

BusyBox project BusyBox wget version prior to commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e contains a Buffer Overflow vulnerability in Busybox wget that can result in heap buffer overflow. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in after commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e.

CVSS metrics

6 scores · 4 sources · 3 versions

EPSS trend

Probability

32.92%

Chance of exploitation in the next 30 days

Percentile

98%

Versus all other CVEs

30-day change

0.00 pp

From 32.92% on 18-09-2026

18-09-202618-10-2026
EPSS score
32.92%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Debian2 products
Busybox1 product
Canonical1 product
Ubuntu1 product
  • busybox< 1:1.21.0-1ubuntu1.4 | < 1:1.22.0-15ubuntu1.4 | < 1:1.27.2-2ubuntu3.2

4 vendors · 5 products

References

8 links