CVE-2018-16866: canonical ubuntu_linux Out-of-bounds Read
Vulnerability summary
CVE-2018-16866 is a medium (CVSS 4.3) Out-of-bounds Read vulnerability in canonical ubuntu_linux. EPSS estimates a 1.05% chance of exploitation in the next 30 days, higher than 64.3% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 4.3, adjacent network); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 9 · Related 5Timeline
- 11-01-2019PublishedVulnerability first disclosed.
- 09-06-2025Last modifiedVulnerability information updated.
Description
An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate with a colon ':'. A local attacker can use this flaw to disclose process memory data. Versions from v221 to v239 are vulnerable.
CVSS metrics
8 scores · 5 sources · 3 versions- OSV · UbuntuEcosystem advisory · calculated3.3LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- OSV · DebianEcosystem advisory · calculated3.3LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- OSV · ChainguardEcosystem advisory · calculated3.3LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- NVDNIST4.3MediumCVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated3.3LowCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NDiffers
EPSS trend
Probability
1.05%
Chance of exploitation in the next 30 days
Percentile
64%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.05% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (qualys.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: adjacent network, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat16 products
- enterprise_linuxEOL7.6
- enterprise_linux_compute_node_eus7.6
- enterprise_linux_desktop7.0
- enterprise_linux_for_ibm_z_systems_eus7.6
- enterprise_linux_for_ibm_z_systems_\(structure_a\)7_s390x
Chainguard5 products
- py3-systemdAll versions (No fix recorded)
- py3.10-systemdAll versions (No fix recorded)
- py3.11-systemdAll versions (No fix recorded)
- py3.12-systemdAll versions (No fix recorded)
- py3.13-systemdAll versions (No fix recorded)
Debian2 products
- systemd< 240-1
- debian_linuxEOL9.0
Canonical1 product
- ubuntu_linuxEOL16.04 | 18.04 | 18.10
Netapp1 product
Systemd_project1 product
- systemd≥ 221, ≤ 239
The systemd project1 product
- systemdfrom v221 to v239
Ubuntu1 product
- systemd< 229-4ubuntu21.15 | < 237-3ubuntu10.11
8 vendors · 28 products
References
19 links
- www.qualys.com/2019/01/09/system-down/system-down.txtX Refsource MISCExploitThird Party AdvisoryEVIDENCE
- bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16866X Refsource CONFIRMIssue TrackingPatchThird Party AdvisoryFIX
- www.openwall.com/lists/oss-security/2019/05/10/4Mailing ListX Refsource MLISTThird Party AdvisoryAdvisory
- packetstormsecurity.com/files/152841/System-Down-A-systemd-journald-Exploit.htmlX Refsource MISCThird Party AdvisoryVDB EntryAdvisory
Show all 19 references
- access.redhat.com/errata/RHSA-2019:2091Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
- access.redhat.com/errata/RHSA-2019:3222Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
- access.redhat.com/errata/RHSA-2020:0593Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
