CVE-2018-25268

LanSpy version 2.0.1.159 is vulnerable to a local buffer overflow condition in its scan field functionality. By submitting oversized input consisting of 688 bytes of padding followed by 4 bytes of controlled data, an attacker can overwrite the instruction pointer, potentially leading to application crash or arbitrary code execution. The vulnerability carries a CVSS v3.1 score of 8.4 (HIGH) with a local attack vector requiring no privileges or user interaction. All impact categories—confidentiality, integrity, and availability—are rated as HIGH, indicating complete system compromise is possible if code execution is achieved. There is no evidence of active exploitation in the wild. The vulnerability does not appear on the Known Exploited Vulnerabilities (KEV) catalog, the Hot List remains inactive, and the EPSS score of 0.00013 indicates minimal real-world prevalence compared to other vulnerabilities. However, the relatively straightforward nature of the overflow and availability of proof-of-concept details warrant monitoring for future exploitation activity.