PatchSiren

PatchSiren cyber security CVE debrief

CVE-2018-25323 Unknown Vendor CVE debrief

CVE-2018-25323 describes a structured exception handler (SEH) buffer overflow in Allok AVI DivX MPEG to DVD Converter 2.6.1217. The supplied description says a local attacker can trigger arbitrary code execution by supplying a malicious payload, including crafted content pasted into the License Name field. NVD classifies the issue as CWE-120 and assigns a high-severity CVSS score.

Vendor
Unknown Vendor
Product
Unknown
CVSS
HIGH 8.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-17
Original CVE updated
2026-05-18
Advisory published
2026-05-17
Advisory updated
2026-05-18

Who should care

Administrators and users responsible for endpoints that still run Allok AVI DivX MPEG to DVD Converter 2.6.1217, especially systems where untrusted local users can interact with the application or its input fields.

Technical summary

The vulnerability is a local buffer overflow affecting the application's exception-handling path. According to the supplied record, a specially crafted payload can overwrite SEH-related values and lead to arbitrary code execution. The NVD metadata uses a CVSS v4 vector with AV:L, AC:L, PR:N, UI:N, and high impact to confidentiality, integrity, and availability; the primary weakness is listed as CWE-120.

Defensive priority

High. Although exploitation is local rather than remote, successful abuse can yield arbitrary code execution on the affected machine. Prioritize removal, isolation, or replacement of the affected software on any live endpoints.

Recommended defensive actions

  • Inventory systems that still have Allok AVI DivX MPEG to DVD Converter 2.6.1217 installed.
  • Remove or replace the application if it is no longer required, especially on shared or multi-user endpoints.
  • If immediate removal is not possible, restrict access to the affected machine and limit who can interact with the application.
  • Run the software only in a tightly isolated environment if it must be retained for compatibility reasons.
  • Review the two referenced advisories and the NVD record before making remediation decisions, since the supplied corpus does not include a vendor fix notice.

Evidence notes

The supplied NVD record for CVE-2018-25323 was published and modified on 2026-05-17. Its metadata references Exploit-DB entry 44363 and a VulnCheck advisory for Allok AVI DivX MPEG to DVD Converter buffer overflow SEH, and lists CWE-120 with a local attack vector and high impact.

Sources and references

Verified primary and authoritative sources

  • CVE-2018-25323 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2018-25323

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2018-25323 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2018-25323

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.