CVE-2018-9918: canonical ubuntu_linux Uncontrolled Recursion
Vulnerability summary
CVE-2018-9918 is a high (CVSS 7.8) Uncontrolled Recursion vulnerability in canonical ubuntu_linux. EPSS estimates a 1.67% chance of exploitation in the next 30 days, higher than 76.5% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 10-04-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
libqpdf.a in QPDF through 8.0.2 mishandles certain "expected dictionary key but found non-name object" cases, allowing remote attackers to cause a denial of service (stack exhaustion), related to the QPDFObjectHandle and QPDF_Dictionary classes, because nesting in direct objects is not restricted.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.67%
Chance of exploitation in the next 30 days
Percentile
77%
Versus all other CVEs
30-day change
0.00 pp
From 1.67% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundQpdf
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Suse3 products
- qpdf&distro=SUSE Linux Enterprise Server 12 SP5< 7.1.1-3.11.1
- qpdf&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5< 7.1.1-3.11.1
- qpdf&distro=SUSE Linux Enterprise Software Development Kit 12 SP5< 7.1.1-3.11.1
Mageia2 products
- qpdf< 7.1.1-1.1.mga5
- qpdf< 7.1.1-1.1.mga6
Canonical1 product
- ubuntu_linuxEOL14.04 | 16.04 | 17.10
Debian1 product
- qpdf< 8.0.2-3
Qpdf_project1 product
- qpdf≤ 8.0.2
Ubuntu1 product
- qpdf< 8.0.2-3~14.04.1 | < 8.0.2-3~16.04.1
6 vendors · 9 products
