CVE-2018-11130: The header::add_FORMAT_descriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers to caus...

Security readout for executives and security teams

CVE-2018-11130 affects VCFtools 0.1.15 when it processes a specially crafted VCF file. A malicious file can crash the tool through a use-after-free condition, and the public description leaves other impacts unspecified. The business risk is highest where genomic data pipelines automatically process files from outside parties. Exposure is likely limited to systems using VCFtools 0.1.15 or affected distro packages to process VCF files, especially shared research, clinical, or batch-analysis pipelines that ingest third-party or uploaded datasets. Treat as a targeted operational resilience issue, not an internet-wide emergency. Prioritize patching where VCFtools processes external genomic data or supports production research and clinical workflows. Mitigation focus: Apply the relevant Ubuntu or Debian vcftools security update where applicable.; Check upstream or distribution guidance for fixed package versions.; Avoid processing untrusted VCF files with unpatched VCFtools..

Prepared

Jun 7, 2026, 13:21 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.