CVE-2018-20548

HIGH

There is an illegal WRITE memory access at common-image.c (function load_image) in libcaca 0.99.beta19 for 1bpp data.

Affects 4 products across 4 vendors.

CVSS 3.18.8
EPSS1.8%
Percentile78th
PatchPatched
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, requires user interaction, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-119: Improper Restriction of Operations within Memory Buffer

Parent class for buffer-related vulnerabilities where operations exceed buffer boundaries.

Related Attack Patterns (CAPEC)
CAPEC-8 Buffer Overflow in an API Call
via CWE-119
CAPEC-9 Buffer Overflow in Local Command-Line Utilities
via CWE-119
CAPEC-10 Buffer Overflow via Environment Variables
via CWE-119
CAPEC-14 Client-side Injection-induced Buffer Overflow
via CWE-119
CAPEC-24 Filter Failure through Buffer Overflow
via CWE-119
Show all 12

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

This vulnerability was disclosed in 2018. A high severity vulnerability affects Canonical systems (CVE-2018-20548). No public exploit code is currently available. Isolate affected systems if patching is not feasible.

BSID: BS-2018-GLOBAL-349828-H • Model: rule-based-v1 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2018-20548?
This vulnerability was disclosed in 2018. A high severity vulnerability affects Canonical systems (CVE-2018-20548). No public exploit code is currently available. Isolate affected systems if patching is not feasible.
What is the CVSS score for CVE-2018-20548?
CVE-2018-20548 has CVSS 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS: 1.8%.
Is CVE-2018-20548 actively exploited?
No confirmed active exploitation of CVE-2018-20548 as of 2026-05-30.
How do I remediate CVE-2018-20548?
Priority: MEDIUM.
What systems are affected by CVE-2018-20548?
CVE-2018-20548 affects Canonical Ubuntu Linux; Fedoraproject Fedora; Libcaca Project Libcaca; Opensuse Leap.
Vulnerability Details
CVE IDCVE-2018-20548
BSIDBS-2018-GLOBAL-349828-H BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published2018-12-28
Last Modified2024-11-21
ICS Relevance15%
Weakness (CWE)
Improper Restriction of Operations within Memory Buffer
SourceNVD
Official Description

There is an illegal WRITE memory access at common-image.c (function load_image) in libcaca 0.99.beta19 for 1bpp data.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

Vulnerability details: There is an illegal WRITE memory access at common-image.c (function load_image) in libcaca 0.99.beta19 for 1bpp data. CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Exploitation Likelihood: MINIMAL

Affected Products
VendorProductAffected Versions
Canonical Ubuntu Linux 12.04 14.04 16.04 18.04 18.10
Fedoraproject Fedora 34 35 36
Libcaca Project Libcaca 0.99
Opensuse Leap 15.0
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 2848 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Modelrule-based-v1
ConfidenceMEDIUM
Enriched At2026-05-24
SHA-512 Audit Hash07f6532b461b9e53d7772449f35d04bbdcadae1c4787e20737ef5431caf2531b7f101697e891a66f0de81b5ab0d394c7bccd4ae67364d20dd1d1da47e0f0b43e
Related CVEs affecting Canonical
CVE-2012-0444 10.0 Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 ... CVE-2012-3963 10.0 Use-after-free vulnerability in the js::gc::MapAllocToTraceKind function in M... CVE-2012-3961 10.0 Use-after-free vulnerability in the RangeData implementation in Mozilla Firef... CVE-2015-2724 10.0 Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox... CVE-2017-16845 10.0 hw/input/ps2.c in Qemu does not validate 'rptr' and 'count' values during gue...
View all Canonical CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →