CVE-2018-6233: trend micro trend micro maximum security Classic Buffer Overflow

Vulnerability summary

CVE-2018-6233 is a high (CVSS 7.8) Classic Buffer Overflow vulnerability in trend micro trend micro maximum security. EPSS estimates a 0.49% chance of exploitation in the next 30 days, higher than 40.5% of scored vulnerabilities.

Timeline

1. 25-05-2018
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

A buffer overflow privilege escalation vulnerability in Trend Micro Maximum Security (Consumer) 2018 could allow a local attacker to escalate privileges on vulnerable installations due to a flaw within processing of IOCTL 0x222060 by the tmnciesc.sys driver. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

• CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.