CVE-2018-16530: forcepoint email_security Out-of-bounds Write

Vulnerability summary

CVE-2018-16530 is a critical (CVSS 9.8) Out-of-bounds Write vulnerability in forcepoint email_security. EPSS estimates a 3.44% chance of exploitation in the next 30 days, higher than 88.8% of scored vulnerabilities.

Timeline

1. 09-04-2019
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

A stack-based buffer overflow in Forcepoint Email Security version 8.5 allows an attacker to craft malicious input and potentially crash a process creating a denial-of-service. While no known Remote Code Execution (RCE) vulnerabilities exist, as with all buffer overflows, the possibility of RCE cannot be completely ruled out. Data Execution Protection (DEP) is already enabled on the Email appliance as a risk mitigation.

• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.