CVE-2012-10057

Lattice Semiconductor ispVM System v18.0.2 contains a buffer overflow vulnerability in its handling of .xcf project files. When parsing the version attribute of the ispXCF XML tag, the application fails to properly validate input length, allowing a specially crafted file to overwrite memory on the stack. This can result in arbitrary code execution under the context of the user who opens the file. The vulnerability is triggered locally by opening a malicious .xcf file and does not require elevated privileges.

• CWE-121

• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/ispvm_xcf_ispxcf.rb
• https://web.archive.org/web/20121014002756/http://secunia.com/advisories/48740/
• https://www.exploit-db.com/exploits/18947
• https://www.latticesemi.com/ispvm
• https://www.vulncheck.com/advisories/lattice-semiconductor-ispvm-system-xcf-file-handling-buffer-overflow
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/ispvm_xcf_ispxcf.rb
• https://www.exploit-db.com/exploits/18947

Published

Aug 13, 2025

Last Modified

Jun 16, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-10051Photodex ProShow Producer version 5.0.3256 contains a stack-…8.4
• CVE-2012-10052EGallery version 1.2 contains an unauthenticated arbitrary f…9.3
• CVE-2012-10053Simple Web Server 2.2 rc2 contains a stack-based buffer over…9.3
• CVE-2012-10054Umbraco CMS versions prior to 4.7.1 are vulnerable to unauth…9.8
• CVE-2012-10055ComSndFTP FTP Server version 1.3.7 Beta contains a format st…9.3
• CVE-2012-10056PHP Volunteer Management System v1.0.2 contains an arbitrary…8.7
• CVE-2012-10058RabidHamster R4 v1.25 contains a stack-based buffer overflow…10
• CVE-2012-10059Dolibarr ERP/CRM versions <= 3.1.1 and <= 3.2.0 contain a po…9.4
• CVE-2012-1006Multiple cross-site scripting (XSS) vulnerabilities in Apach…
• CVE-2012-10060Sysax Multi Server versions prior to 5.55 contain a stack-ba…9.8
• CVE-2012-10061Sockso Music Host Server versions <= 1.5 are vulnerable to a…8.7
• CVE-2012-10062A vulnerability in XAMPP, developed by Apache Friends, versi…8.7