What’s Vulnerable › Vulnerabilities

CVE-2018-3990

• Severity: high (CVSS 7.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-02-05 · updated 2026-06-17
• Weakness: CWE-119

Description

An exploitable pool corruption vulnerability exists in the 0x8200E804 IOCTL handler functionality of WIBU-SYSTEMS WibuKey.sys Version 6.40 (Build 2400). A specially crafted IRP request can cause a buffer overflow, resulting in kernel memory corruption and, potentially, privilege escalation. An attacker can send an IRP request to trigger this vulnerability.

Affected products

• WibuKey Runtime: 6.40

References

• http://www.securityfocus.com/bid/107005
• https://cert-portal.siemens.com/productcert/pdf/ssa-760124.pdf
• https://cert-portal.siemens.com/productcert/pdf/ssa-844562.pdf
• https://cert-portal.siemens.com/productcert/pdf/ssa-902727.pdf
• https://talosintelligence.com/vulnerability_reports/TALOS-2018-0658
• http://www.securityfocus.com/bid/107005
• https://cert-portal.siemens.com/productcert/pdf/ssa-760124.pdf
• https://cert-portal.siemens.com/productcert/pdf/ssa-844562.pdf
• https://cert-portal.siemens.com/productcert/pdf/ssa-902727.pdf
• https://talosintelligence.com/vulnerability_reports/TALOS-2018-0658

Get alerted when CVE-2018-3990 or the next vulnerability affects your stack