CVE-2018-10756

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-05-15 · updated 2026-06-17
Weakness: CWE-416

Description

Use-after-free in libtransmission/variant.c in Transmission before 3.00 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted torrent file.

Affected products

Debian Linux: 8.0, 9.0
Fedoraproject Fedora: 31, 32
Transmissionbt Transmission: before 3.00 — fixed in 3.00

How to fix

Upgrade to a fixed version: Transmissionbt Transmission 3.00. Check the vendor advisory for mitigations.

References

https://github.com/transmission/transmission/commit/2123adf8e5e1c2b48791f9d22fc8c747e974180e
https://lists.debian.org/debian-lts-announce/2020/05/msg00022.html
https://lists.debian.org/debian-lts-announce/2020/08/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CD3GLZ5URIK74RCGLSH72IVLDIJJMLQC/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OVAG2HNKNRLWOACFN5F2ANJD2SQ53WI7/
https://security.gentoo.org/glsa/202007-07
https://tomrichards.net/2020/05/cve-2018-10756-transmission/
https://github.com/transmission/transmission/commit/2123adf8e5e1c2b48791f9d22fc8c747e974180e
https://lists.debian.org/debian-lts-announce/2020/05/msg00022.html
https://lists.debian.org/debian-lts-announce/2020/08/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CD3GLZ5URIK74RCGLSH72IVLDIJJMLQC/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OVAG2HNKNRLWOACFN5F2ANJD2SQ53WI7/

Get alerted when CVE-2018-10756 or the next vulnerability affects your stack