CVE-2018-25265

CVE-2018-25265 is a local buffer overflow vulnerability affecting LanSpy version 2.0.1.159 in its scan functionality. The flaw allows unauthenticated local attackers to execute arbitrary code by exploiting structured exception handling (SEH) mechanisms and employing egghunter techniques to inject and execute malicious shellcode. The vulnerability carries a HIGH severity rating with a CVSS score of 8.4, reflecting a local attack vector with low complexity and no user interaction required. The attack provides complete compromise of confidentiality, integrity, and availability on the affected system, though it requires local system access rather than remote exploitation capability. Exploitation status indicates this vulnerability currently has low public attention and no known active exploitation in the wild. The EPSS score of 0.0001 suggests minimal probability of exploitation, and the vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog. No public exploit code appears readily available, contributing to the lower community attention and practical threat level despite its technical severity rating.