PatchSiren

PatchSiren cyber security CVE debrief

CVE-2018-25255 10-Strike CVE debrief

CVE-2018-25255 is a local buffer overflow vulnerability in 10-Strike LANState 8.8. The vulnerability allows local attackers to execute arbitrary code by crafting malicious LSM map files. Attackers can create a specially formatted LSM file with a payload in the ObjCaption parameter that overflows the buffer, overwrites the SEH chain, and executes shellcode when the file is opened in the application.

Vendor
10-Strike
Product
Strike LANState
CVSS
HIGH 8.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-04
Original CVE updated
2026-07-20
Advisory published
2026-04-04
Advisory updated
2026-07-20

Who should care

Users of 10-Strike LANState 8.8 should apply patches or mitigations to prevent local attackers from exploiting this vulnerability.

Technical summary

The vulnerability is caused by a local buffer overflow in structured exception handling. Malicious LSM map files can be crafted to execute arbitrary code. The vulnerability has a CVSS score of 8.6 and a severity of HIGH.

Defensive priority

High priority should be given to patching or mitigating this vulnerability to prevent local attackers from executing arbitrary code.

Recommended defensive actions

  • Apply patches or updates provided by the vendor to fix the buffer overflow vulnerability
  • Implement compensating controls such as restricting access to LSM map files
  • Monitor systems for suspicious activity related to LSM map files
  • Conduct regular vulnerability assessments and penetration testing to identify potential weaknesses

Evidence notes

The CVE record was published on 2026-04-04T14:16:21.907Z and has not been modified since then. The NVD entry is currently Deferred.

Sources and references

Verified primary and authoritative sources

  • CVE-2018-25255 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2018-25255

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2018-25255 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2018-25255

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.