What’s Vulnerable › Vulnerabilities

CVE-2017-20227: JAD 1.5.8e-1kali1 Stack-Based Buffer Overflow

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-03-28 · updated 2026-06-17
• Weakness: CWE-787

Description

JAD Java Decompiler 1.5.8e-1kali1 and prior contains a stack-based buffer overflow vulnerability that allows attackers to execute arbitrary code by supplying overly long input that exceeds buffer boundaries. Attackers can craft malicious input passed to the jad command to overflow the stack and execute a return-oriented programming chain that spawns a shell.

Affected products

• Varaneckas JAD Java Decompiler: 1.5.8e-1kali1

References

• http://www.varaneckas.com/jad/
• https://www.exploit-db.com/exploits/42255
• https://www.vulncheck.com/advisories/jad-8e-1kali1-stack-based-buffer-overflow

Get alerted when CVE-2017-20227 or the next vulnerability affects your stack