CVE-2018-8778

27

FAUCET Score

CVE-2018-8778 is a buffer under-read vulnerability in the String#unpack method of Ruby versions prior to 2.2.10, 2.3.7, 2.4.4, 2.5.1, and 2.6.0-preview1, affecting products like Canonical, Debian, Red Hat, and Ruby-lang. This high-severity vulnerability (CVSS 7.5) allows an unauthenticated attacker to trigger massive and controlled information disclosure without user interaction. While no public exploit code (Metasploit, Nuclei, ExploitDB) is available and it's not listed in CISA's KEV catalog, there has been some community discussion and media coverage, indicating awareness of its potential impact.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		>= 2.2.0, < 2.2.10CPE matchmatch criteria	cpe:2.3:a:ruby-lang:ruby::::::::
		>= 2.3.0, < 2.3.7CPE matchmatch criteria	cpe:2.3:a:ruby-lang:ruby::::::::
		>= 2.4.0, < 2.4.4CPE matchmatch criteria	cpe:2.3:a:ruby-lang:ruby::::::::
		>= 2.5.0, < 2.5.1CPE matchmatch criteria	cpe:2.3:a:ruby-lang:ruby::::::::
		2.6.0CPE matchmatch criteria	cpe:2.3:a:ruby-lang:ruby:2.6.0:preview1::::::

CVSS Data

CVSS version used by this source: 3.0

7.5HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

Exploitability Score

3.9

Impact Score

3.6

CvssVersion

3.0

Exploit Intelligence

EPSS Score

7.83%

Probability of exploitation in next 30 days

EPSS Percentile

94.0%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

This CVE's current EPSS score of 0.0783 is in the 90th percentile among its peer group of 51,506 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (24)

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: ruby-0:2.0.0.648-36.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7.4 Advanced Update SupportFixed in: ruby-0:2.0.0.648-36.el7_4

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7.4 Telco Extended Update SupportFixed in: ruby-0:2.0.0.648-36.el7_4

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7.4 Update Services for SAP SolutionsFixed in: ruby-0:2.0.0.648-36.el7_4

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7.5 Extended Update SupportFixed in: ruby-0:2.0.0.648-36.el7_5

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7.6 Extended Update SupportFixed in: ruby-0:2.0.0.648-37.el7_6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6Fixed in: rh-ruby23-ruby-0:2.3.8-69.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6Fixed in: rh-ruby24-ruby-0:2.4.5-91.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: rh-ruby23-ruby-0:2.3.8-69.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: rh-ruby24-ruby-0:2.4.5-91.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: rh-ruby25-ruby-0:2.5.3-6.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUSFixed in: rh-ruby23-ruby-0:2.3.8-69.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUSFixed in: rh-ruby24-ruby-0:2.4.5-91.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUSFixed in: rh-ruby25-ruby-0:2.5.3-6.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUSFixed in: rh-ruby23-ruby-0:2.3.8-69.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUSFixed in: rh-ruby24-ruby-0:2.4.5-91.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUSFixed in: rh-ruby25-ruby-0:2.5.3-6.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUSFixed in: rh-ruby23-ruby-0:2.3.8-69.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUSFixed in: rh-ruby24-ruby-0:2.4.5-91.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUSFixed in: rh-ruby25-ruby-0:2.5.3-6.el7

redhatend of lifevia redhat_api

Product: Red Hat Enterprise Linux 5Fixed in: ruby

redhatend of lifevia redhat_api

Product: Red Hat Enterprise Linux 6Fixed in: ruby

redhatend of lifevia redhat_api

Product: Red Hat Software CollectionsFixed in: rh-ruby22-ruby

redhatend of lifevia redhat_api

Product: Red Hat Subscription Asset ManagerFixed in: ruby193-ruby

Vendor Advisories (1)

redhatCVE-2018-8778Moderate

ruby: Buffer under-read in String#unpack

References

lists.opensuse.org / opensuse-security-announce/2019-07/msg00036.html

access.redhat.com / errata/RHSA-2018:3729

Third Party Advisory

access.redhat.com / errata/RHSA-2018:3730

Third Party Advisory

access.redhat.com / errata/RHSA-2018:3731

Third Party Advisory

access.redhat.com / errata/RHSA-2019:2028

lists.debian.org / debian-lts-announce/2018/04/msg00023.html

Mailing ListThird Party Advisory

lists.debian.org / debian-lts-announce/2018/04/msg00024.html

Mailing ListThird Party Advisory

lists.debian.org / debian-lts-announce/2018/07/msg00012.html

Mailing ListThird Party Advisory

usn.ubuntu.com / 3626-1

Third Party Advisory

debian.org / security/2018/dsa-4259

Third Party Advisory

ruby-lang.org / en/news/2018/03/28/buffer-under-read-unpack-cve-2018-8778

Vendor Advisory

ruby-lang.org / en/news/2018/03/28/ruby-2-2-10-released

PatchVendor Advisory

ruby-lang.org / en/news/2018/03/28/ruby-2-3-7-released

PatchVendor Advisory

ruby-lang.org / en/news/2018/03/28/ruby-2-4-4-released

PatchVendor Advisory

ruby-lang.org / en/news/2018/03/28/ruby-2-5-1-released

PatchVendor Advisory

securityfocus.com / bid/103693

Third Party AdvisoryVDB Entry

securitytracker.com / id/1042004

Third Party AdvisoryVDB Entry