CVE-2018-18311

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 11.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-12-07 · updated 2026-06-17
Weakness: CWE-190

Description

Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

Affected products

macOS: before 10.14.4 — fixed in 10.14.4
Canonical Ubuntu Linux: 12.04, 14.04, 16.04, 18.04, 18.10
Debian Linux: 8.0, 9.0
Fedoraproject Fedora: 29
McAfee Web Gateway (MWG): from 7.7.2 before 7.7.2.21; from 7.8.2 before 7.8.2.8; from 8.0.0 before 8.1.1 — fixed in 7.7.2.21, 7.8.2.8, 8.1.1
E-Series SANtricity OS Controller Software 11.x: all versions
NetApp Snap Creator Framework: all versions
NetApp SnapCenter: all versions
NetApp Snapdriver: all versions
perl: before 5.26.3; from 5.28.0 before 5.28.1 — fixed in 5.26.3, 5.28.1
Red Hat Enterprise Linux: 6.0, 7.0, 7.4, 7.5, 7.6
RedHat Enterprise Linux Desktop: 7.0
RedHat Enterprise Linux Eus: 7.6
RedHat Enterprise Linux Server: 7.0
RedHat Enterprise Linux Server Aus: 7.6
RedHat Enterprise Linux Server Tus: 7.6
RedHat Enterprise Linux Workstation: 7.0
Red Hat OpenShift Container Platform 4.18: 3.11

How to fix

Upgrade to a fixed version: macOS 10.14.4; McAfee Web Gateway (MWG) 7.7.2.21, 7.8.2.8, 8.1.1; perl 5.26.3, 5.28.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2018-18311 or the next vulnerability affects your stack