How severe is CVE-2018-1125?

CVE-2018-1125 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2018-1125 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (80th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2018-1125?

CVE-2018-1125 primarily affects Procps-ng Project Procps-ng. In total, 10 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2018-1125?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2018-1125 published?

CVE-2018-1125 was published on 2018-05-23 and last updated on 2026-06-17.

CVE-2018-1125

CVE-2018-1125 is a high-severity vulnerability in Procps-ng Project Procps-ng with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-121.

Key facts

Severity: High (CVSS 3.x base score 7.5)
CVSS v2: 5.0
EPSS exploit prediction: 2% (80th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-121
Affected product: Procps-ng Project Procps-ng
Published: 2018-05-23
Last modified: 2026-06-17

Description

procps-ng before version 3.3.15 is vulnerable to a stack buffer overflow in pgrep. This vulnerability is mitigated by FORTIFY, as it involves strncat() to a stack-allocated string. When pgrep is compiled with FORTIFY (as on Red Hat Enterprise Linux and Fedora), the impact is limited to a crash.

Frequently asked questions

What is CVE-2018-1125?: procps-ng before version 3.3.15 is vulnerable to a stack buffer overflow in pgrep. This vulnerability is mitigated by FORTIFY, as it involves strncat() to a stack-allocated string. When pgrep is compiled with FORTIFY (as on Red Hat Enterprise Linux and Fedora), the impact is limited to a crash.
How severe is CVE-2018-1125?: CVE-2018-1125 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2018-1125 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (80th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2018-1125?: CVE-2018-1125 primarily affects Procps-ng Project Procps-ng. In total, 10 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2018-1125?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2018-1125 published?: CVE-2018-1125 was published on 2018-05-23 and last updated on 2026-06-17.

References

Affected products (10)

cpe:2.3:a:procps-ng_project:procps-ng:*:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

More vulnerabilities in Procps-ng Project Procps-ng

CVE-2018-1124 — High (CVSS 7.8): procps-ng before version 3.3.15 is vulnerable to multiple integer overflows leading to a heap corruption in file2strvec…
CVE-2018-1122 — High (CVSS 7.3): procps-ng before version 3.3.15 is vulnerable to a local privilege escalation in top. If a user runs top with HOME…
CVE-2018-1126 — Medium (CVSS 4.8): procps-ng before version 3.3.15 is vulnerable to an incorrect integer size in proc/alloc.* leading to…
CVE-2018-1123 — Low (CVSS 3.9): procps-ng before version 3.3.15 is vulnerable to a denial of service in ps via mmap buffer overflow. Inbuilt protection…

All CVEs affecting Procps-ng Project Procps-ng →

Other CWE-121 (Stack-based Buffer Overflow) vulnerabilities

CVE-2026-12848 — Critical (CVSS 10.0): GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and…
CVE-2026-12847 — Critical (CVSS 10.0): GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and…
CVE-2026-12846 — Critical (CVSS 10.0): GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and…
CVE-2026-12485 — Critical (CVSS 10.0): GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and…
CVE-2026-37541 — Critical (CVSS 10.0): Buffer overflow vulnerability in Open Vehicle Monitoring System 3 (OVMS3) 3.3.005. In canformat_gvret.cpp, the length…
CVE-2026-42996 — Critical (CVSS 10.0): JS8Call through 2.3.1 and JS8Call-improved before 3.0 have a stack-based buffer overflow via a radio transmission of…

Browse all CWE-121 (Stack-based Buffer Overflow) vulnerabilities →