PatchSiren

PatchSiren cyber security CVE debrief

CVE-2018-25322 Unknown Vendor CVE debrief

CVE-2018-25322 describes a stack-based buffer overflow in Allok Fast AVI MPEG Splitter 1.2. According to the supplied source material, a local attacker can trigger the issue by supplying a crafted license name string, which may allow arbitrary code execution with the application's privileges. The vulnerability is rated high severity in the supplied data and should be treated as important anywhere the affected software is installed.

Vendor
Unknown Vendor
Product
Unknown
CVSS
HIGH 8.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-17
Original CVE updated
2026-05-18
Advisory published
2026-05-17
Advisory updated
2026-05-18

Who should care

Organizations or individuals using Allok Fast AVI MPEG Splitter 1.2, especially on shared workstations, analyst systems, or any environment where local users or untrusted inputs can interact with the application.

Technical summary

The vulnerability is identified as CWE-121 (stack-based buffer overflow). The supplied description says the overflow is reachable through the License Name field, where a malicious string can overwrite stack memory and enable code execution. The NVD record in the provided corpus classifies the issue as local (AV:L) with no user interaction required and high impact to confidentiality, integrity, and availability. Vendor attribution in the corpus is not fully confirmed; the evidence points to Alloksoft, but the vendor field is marked low confidence.

Defensive priority

High for any environment where the affected software is installed and in active use. Prioritize remediation if the application is present on systems with sensitive data or local multi-user access.

Recommended defensive actions

  • Remove or replace Allok Fast AVI MPEG Splitter 1.2 if it is no longer needed.
  • If the software must remain installed, restrict who can run it and limit local access on affected systems.
  • Review whether any license-entry workflows accept untrusted data and isolate or disable them where possible.
  • Monitor the vendor and advisory references for a patched release or formal remediation guidance.
  • Treat the software as unsafe until verification confirms a fixed version is deployed.

Evidence notes

This debrief is based only on the supplied NVD record and the referenced third-party sources. The source corpus identifies CVE-2018-25322 as a stack-based buffer overflow in Allok Fast AVI MPEG Splitter 1.2, with CWE-121 assigned. The vendor mapping is uncertain: the corpus includes a candidate reference to Alloksoft, but the vendor field is explicitly low confidence and needs review. No KEV entry is present in the supplied data.

Official resources

The supplied corpus shows the CVE record as published and modified on 2026-05-17. That timestamp reflects record timing in the dataset, not necessarily the original discovery date. No Known Exploited Vulnerabilities entry is present in the