CVE-2018-11438

The mobi_decompress_lz77 function in compression.c in Libmobi 0.3 allows remote attackers to cause remote code execution (heap-based buffer overflow) via a crafted mobi file.

• CWE-787

• http://seclists.org/fulldisclosure/2018/May/48Exploit, Mailing List, Third Party Advisory
• http://seclists.org/fulldisclosure/2018/May/48Exploit, Mailing List, Third Party Advisory

Published

May 30, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-11432The mobi_parse_mobiheader function in read.c in Libmobi 0.3 …
• CVE-2018-11433The mobi_get_kf8boundary_seqnumber function in util.c in Lib…
• CVE-2018-11434The buffer_fill64 function in compression.c in Libmobi 0.3 a…
• CVE-2018-11435The mobi_decompress_huffman_internal function in compression…
• CVE-2018-11436The buffer_addraw function in buffer.c in Libmobi 0.3 allows…
• CVE-2018-11437The mobi_reconstruct_parts function in parse_rawml.c in Libm…
• CVE-2018-11439The TagLib::Ogg::FLAC::File::scan function in oggflacfile.cp…6.5
• CVE-2018-1144A remote unauthenticated user can execute commands as root i…
• CVE-2018-11440Liblouis 3.5.0 has a stack-based Buffer Overflow in the func…
• CVE-2018-11442A CSRF issue was discovered in EasyService Billing 1.0, whic…
• CVE-2018-11443The parameter q is affected by Cross-site Scripting in jobca…
• CVE-2018-11444A SQL Injection issue was observed in the parameter "q" in j…