LiveActive security incident?Get immediate response
CVE Record

CVE-2018-3889: A specially crafted PCX image processed via the application can lead to an out-of-bounds write, overwriting...

A specially crafted PCX image processed via the application can lead to an out-of-bounds write, overwriting arbitrary data. An attacker can deliver a PCX image to trigger this vulnerability and gain code execution.

HighCVSS 8.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A malicious PCX image opened in the affected Photoline version could corrupt memory and potentially let an attacker run code. The issue requires user interaction, but the impact is high if a targeted user opens the file in the vulnerable application.

Executive priority

Prioritize remediation for teams that process images from customers, vendors, or the public. This is high impact but not automatically exploitable; urgency depends on whether the vulnerable OS X version is deployed and exposed to untrusted PCX files.

Technical view

CVE-2018-3889 is an out-of-bounds write in Computerinsel Photoline 20.53 for OS X when processing specially crafted PCX images. The CVSS 3.0 score is 8.8 with no privileges required and user interaction required. The source bundle states possible arbitrary data overwrite and code execution.

Likely exposure

Exposure appears limited to environments using Computerinsel Photoline 20.53 for OS X, especially where users open externally supplied PCX images. The provided sources do not identify other versions, platforms, or products as affected.

Exploitation context

The CVE is not listed as KEV in the provided bundle, and no cited source states active exploitation. The plausible scenario is social delivery of a crafted PCX image to a user who opens it with the vulnerable application.

Researcher notes

The provided data supports an out-of-bounds write during PCX processing with potential code execution. CVSS indicates remote deliverability, low complexity, no privileges, and required user interaction. No CWE, exploit-in-the-wild evidence, or definitive patch version is included in the bundle.

Mitigation direction

  • Check Computerinsel or Talos guidance for fixed versions or vendor-recommended mitigations.
  • Remove or isolate Photoline 20.53 for OS X where it is not required.
  • Limit opening of PCX files from untrusted or external sources.
  • Use email and web filtering to reduce delivery of unexpected PCX attachments.
  • Run the application with least privilege on managed endpoints where possible.

Validation and detection

  • Inventory macOS endpoints for Computerinsel Photoline 20.53.
  • Confirm whether Photoline is associated with PCX files on user systems.
  • Review recent inbound files or attachments for unexpected PCX images.
  • Check endpoint telemetry for crashes tied to image opening workflows.
  • Verify whether vendor guidance or a fixed build has been applied.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2018-3889 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.8 (3.0)
Known Exploited
No
Published

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.8CVSS 3.0HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H2.85.9Primary CVE score

Vulnerability scoring details

Base CVSS 3.0 score

8.8High
CVSS 3.0 vector shape for CVE-2018-3889Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
TalosComputerinsel PhotolineComputerinsel Photoline 20.53 for OS XListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.