Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-cg7r-vdas-dud9
Vulnerability ID VCID-cg7r-vdas-dud9
Aliases CVE-2018-5146
Summary An out of bounds memory write while processing Vorbis audio data was reported through the Pwn2Own contest.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-122 Heap-based Buffer Overflow
System Score Found at
cvssv3 8.8 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-5146.json
epss 0.55641 https://api.first.org/data/v1/epss?cve=CVE-2018-5146
cvssv3 8.8 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
archlinux Critical https://security.archlinux.org/AVG-367
archlinux Critical https://security.archlinux.org/AVG-657
archlinux Critical https://security.archlinux.org/AVG-658
archlinux Critical https://security.archlinux.org/AVG-663
generic_textual critical https://www.mozilla.org/en-US/security/advisories/mfsa2018-08
generic_textual critical https://www.mozilla.org/en-US/security/advisories/mfsa2018-09
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-5146.json
https://api.first.org/data/v1/epss?cve=CVE-2018-5146
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5125
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5127
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5129
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5144
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5145
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5146
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5147
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
1557221 https://bugzilla.redhat.com/show_bug.cgi?id=1557221
893130 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=893130
ASA-201803-12 https://security.archlinux.org/ASA-201803-12
ASA-201803-13 https://security.archlinux.org/ASA-201803-13
ASA-201803-21 https://security.archlinux.org/ASA-201803-21
ASA-201803-22 https://security.archlinux.org/ASA-201803-22
AVG-367 https://security.archlinux.org/AVG-367
AVG-657 https://security.archlinux.org/AVG-657
AVG-658 https://security.archlinux.org/AVG-658
AVG-663 https://security.archlinux.org/AVG-663
GLSA-201811-13 https://security.gentoo.org/glsa/201811-13
mfsa2018-08 https://www.mozilla.org/en-US/security/advisories/mfsa2018-08
mfsa2018-09 https://www.mozilla.org/en-US/security/advisories/mfsa2018-09
RHSA-2018:0549 https://access.redhat.com/errata/RHSA-2018:0549
RHSA-2018:0647 https://access.redhat.com/errata/RHSA-2018:0647
RHSA-2018:0648 https://access.redhat.com/errata/RHSA-2018:0648
RHSA-2018:0649 https://access.redhat.com/errata/RHSA-2018:0649
RHSA-2018:1058 https://access.redhat.com/errata/RHSA-2018:1058
USN-3604-1 https://usn.ubuntu.com/3604-1/
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-5146.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.98119
EPSS Score 0.55641
Published At May 29, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-29T08:26:37.642252+00:00 Mozilla Importer Import https://github.com/mozilla/foundation-security-advisories/blob/master/announce/2018/mfsa2018-09.yml 38.6.0