Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-e415-z3cf-ekfm
Vulnerability ID VCID-e415-z3cf-ekfm
Aliases CVE-2018-12086
GHSA-782p-53wq-cxmj
Summary Out-of-bounds Write Buffer overflow in OPC UA applications allows remote attackers to trigger a stack overflow with carefully structured requests.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-787 Out-of-bounds Write
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-20 Improper Input Validation
System Score Found at
cvssv3.1 7.5 http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html
generic_textual HIGH http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html
cvssv3 5.3 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-12086.json
epss 0.25733 https://api.first.org/data/v1/epss?cve=CVE-2018-12086
epss 0.25733 https://api.first.org/data/v1/epss?cve=CVE-2018-12086
epss 0.25733 https://api.first.org/data/v1/epss?cve=CVE-2018-12086
epss 0.25733 https://api.first.org/data/v1/epss?cve=CVE-2018-12086
epss 0.25733 https://api.first.org/data/v1/epss?cve=CVE-2018-12086
epss 0.25733 https://api.first.org/data/v1/epss?cve=CVE-2018-12086
epss 0.25733 https://api.first.org/data/v1/epss?cve=CVE-2018-12086
epss 0.25733 https://api.first.org/data/v1/epss?cve=CVE-2018-12086
epss 0.25733 https://api.first.org/data/v1/epss?cve=CVE-2018-12086
cvssv3 7.5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 7.5 https://github.com/advisories/GHSA-782p-53wq-cxmj
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-782p-53wq-cxmj
generic_textual HIGH https://github.com/advisories/GHSA-782p-53wq-cxmj
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2018-12086
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2018-12086
cvssv3.1 7.5 https://opcfoundation-onlineapplications.org/faq/SecurityBulletins/OPC_Foundation_Security_Bulletin_CVE-2018-12086.pdf
generic_textual HIGH https://opcfoundation-onlineapplications.org/faq/SecurityBulletins/OPC_Foundation_Security_Bulletin_CVE-2018-12086.pdf
archlinux High https://security.archlinux.org/AVG-779
cvssv3.1 7.5 https://www.debian.org/security/2018/dsa-4359
generic_textual HIGH https://www.debian.org/security/2018/dsa-4359
cvssv3.1 7.5 http://www.securityfocus.com/bid/105538
generic_textual HIGH http://www.securityfocus.com/bid/105538
cvssv3.1 7.5 http://www.securitytracker.com/id/1041909
generic_textual HIGH http://www.securitytracker.com/id/1041909
Reference id Reference type URL
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-12086.json
https://api.first.org/data/v1/epss?cve=CVE-2018-12086
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12086
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18225
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18226
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18227
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19622
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19623
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19624
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19625
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19626
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19627
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19628
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/advisories/GHSA-782p-53wq-cxmj
https://opcfoundation-onlineapplications.org/faq/SecurityBulletins/OPC_Foundation_Security_Bulletin_CVE-2018-12086.pdf
https://www.debian.org/security/2018/dsa-4359
http://www.securityfocus.com/bid/105538
http://www.securitytracker.com/id/1041909
1642915 https://bugzilla.redhat.com/show_bug.cgi?id=1642915
ASA-201810-9 https://security.archlinux.org/ASA-201810-9
AVG-779 https://security.archlinux.org/AVG-779
CVE-2018-12086 https://nvd.nist.gov/vuln/detail/CVE-2018-12086
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-12086.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/advisories/GHSA-782p-53wq-cxmj
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2018-12086
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://opcfoundation-onlineapplications.org/faq/SecurityBulletins/OPC_Foundation_Security_Bulletin_CVE-2018-12086.pdf
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://www.debian.org/security/2018/dsa-4359
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at http://www.securityfocus.com/bid/105538
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at http://www.securitytracker.com/id/1041909
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.96208
EPSS Score 0.25733
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:47:57.956950+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/nuget/OPCFoundation.NetStandard.Opc.Ua/CVE-2018-12086.yml 38.0.0