CVE-2018-1126: canonical ubuntu_linux Integer Overflow or Wraparound
CVSS: 9.8v3.0CriticalModified
AliasesUBUNTU-CVE-2018-1126DEBIAN-CVE-2018-1126
Published 23-05-2018Last modified 17-12-2025
Vulnerability summary
CVE-2018-1126 is a critical (CVSS 9.8) Integer Overflow or Wraparound vulnerability in canonical ubuntu_linux. EPSS estimates a 1.88% chance of exploitation in the next 30 days, higher than 79% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
9.8/10
010
Critical · v3.0 (NVD)EPSS score
1.88%
0%100%
Low · -0.04 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Advisory lineage
Upstream 0 · Downstream 18 · Related 10Timeline
- 23-05-2018PublishedVulnerability first disclosed.
- 17-12-2025Last modifiedVulnerability information updated.
Description
procps-ng before version 3.3.15 is vulnerable to an incorrect integer size in proc/alloc.* leading to truncation/integer overflow issues. This flaw is related to CVE-2018-1124.
CVSS metrics
5 scores · 4 sources · 2 versionsCritical 9.8Preferred score · NVD (NIST)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSources4 sources · 4.8–9.8
- CVE.orgCNA4.8MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated4.8MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:LDiffers
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
High 7.5Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
1.88%
Chance of exploitation in the next 30 days
Percentile
79%
Versus all other CVEs
30-day change
-0.04 pp
From 1.92% on 18-09-2026
18-09-202618-10-2026
EPSS score1.88%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (qualys.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Redhat6 products
- enterprise_linuxEOL7.0
- enterprise_linux_desktop7.0
- enterprise_linux_server7.0 | 7.5
- enterprise_linux_server_aus6.6
- enterprise_linux_server_tus6.6
Debian2 products
- procps< 2:3.3.15-1
- debian_linuxEOL7.0 | 8.0 | 9.0
[unknown]1 product
- procps-ng, procpsprocps-ng 3.3.15
Canonical1 product
- ubuntu_linuxEOL14.04 | 16.04 | 17.10 | 18.04
Procps-ng_project1 product
- procps-ng< 3.3.15
Schneider-electric1 product
Ubuntu1 product
- procps< 1:3.3.9-1ubuntu2.3 | < 2:3.3.10-4ubuntu2.4 | < 2:3.3.12-3ubuntu1.1
7 vendors · 13 products
References
23 links
- lists.debian.org/debian-lts-announce/2018/05/msg00021.htmlMailing ListX Refsource MLISTThird Party Advisory
Show all 23 references
- bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1126X Refsource CONFIRMIssue TrackingThird Party Advisory
- www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txtX Refsource MISCExploitThird Party AdvisoryREPORT