CVE-2016-20048: iSelect 1.4.0-2+b1 Local Buffer Overflow via key parameter

Severity: high (CVSS 8.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-28 · updated 2026-10-07
Weakness: CWE-22

Description

iSelect 1.4.0-2+b1 contains a local buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying an oversized value to the -k/--key parameter. Attackers can craft a malicious argument containing a NOP sled, shellcode, and return address to overflow a 1024-byte stack buffer and gain code execution with user privileges.

Affected products

iSelect: 1.4.0-2+b1

References

http://www.ossp.org/pkg/tool/iselect/
https://www.exploit-db.com/exploits/41076
https://www.vulncheck.com/advisories/iselect-2-b1-local-buffer-overflow-via-key-parameter

Get alerted when CVE-2016-20048 or the next vulnerability affects your stack