CVE-2018-25267

CVE-2018-25267 is a local buffer overflow vulnerability affecting UltraISO version 9.7.1.3519 in the Make CD/DVD Image dialog. The flaw exists in the Output FileName field, where attackers can craft a malicious filename string to overwrite Structured Exception Handling (SEH) and SE handler records, potentially leading to application crashes. The vulnerability has a CVSS score of 6.2 (Medium severity) with a local attack vector requiring no privileges or user interaction. While the attack complexity is low, the impact is limited to availability, with no confidentiality or integrity compromise possible. This indicates a denial of service risk rather than a critical system compromise. There is currently no evidence of active exploitation, with an EPSS score of 0.00012 indicating minimal real-world exploitation likelihood. The vulnerability is not listed on the CISA KEV catalog and remains inactive on security hot lists, suggesting limited community attention and low practical threat to operational environments at this time.