Security readout for executives and security teams
Plain-English summary
CVE-2018-25238 is a local denial-of-service issue in VSCO 1.1.1.0. A person with local access can crash the application through the search feature using an overly long input. This affects application availability, not data confidentiality or integrity, based on the provided CVSS details.
Executive priority
Treat as a low-to-moderate operational issue. Prioritize remediation where VSCO is installed on shared workstations, kiosks, or systems where application availability matters. It does not currently indicate data theft, privilege escalation, or remote compromise.
Technical view
VSCO 1.1.1.0 mishandles excessively long search input, leading to an application crash. The CVSS v4 vector rates local attack complexity as low, with no privileges required and high vulnerable-system availability impact. The record maps the issue to CWE-1260. Sources do not name a vendor patch or fixed version.
Likely exposure
Exposure appears limited to endpoints running VSCO version 1.1.1.0 where a local user can interact with the application. Server-side or remote network exposure is not indicated in the sources.
Exploitation context
A public ExploitDB entry exists, but the sources do not show active exploitation, and the CVE is not listed as KEV. Practical impact is repeated local application crashes rather than system compromise.
Researcher notes
Evidence supports a local application availability flaw with public proof-of-concept availability. Do not infer broader VSCO versions or platforms beyond version 1.1.1.0. Patch status is not established in the provided sources, so remediation should rely on current vendor or store guidance.
Mitigation direction
- Inventory endpoints for VSCO 1.1.1.0 installations.
- Check the Microsoft Store and vendor channels for updated VSCO versions or guidance.
- Remove or disable VSCO where it is not business-required.
- Limit local access to shared or kiosk systems running the application.
- Monitor for repeated VSCO crashes on affected endpoints.
Validation and detection
- Confirm installed VSCO version through endpoint inventory or software management tools.
- Review application crash logs for VSCO search-related failures.
- Verify whether a newer vendor-provided version is available.
- Confirm affected systems no longer run version 1.1.1.0 after remediation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-1260: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2018-25238 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.9 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
6.9MediumVector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- ExploitDB-46385CVE reference · exploit
- Product ReferenceCVE reference · product
- VulnCheck Advisory: VSCO 1.1.1.0 Denial of Service via SearchCVE reference · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Handling of Overlap Between Protected Memory Ranges
Improper Handling of Overlap Between Protected Memory Ranges represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.