What’s Vulnerable › Vulnerabilities
CVE-2018-6318
- Severity: high (CVSS 7.8 v3.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.0% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2018-02-02 · updated 2026-06-17
- Weakness: CWE-426
Description
In Sophos Tester Tool 3.2.0.7 Beta, the driver loads (in the context of the application used to test an exploit or ransomware) the DLL using a payload that runs from NTDLL.DLL (so, it's run in userland), but the driver doesn't perform any validation of this DLL (not its signature, not its hash, etc.). A person can change this DLL in a local way, or with a remote connection, to a malicious DLL with the same name -- and when the product is used, this malicious DLL will be loaded, aka a DLL Hijacking attack.
Affected products
- Sophos Tester: 3.2.0.7-beta
References
Get alerted when CVE-2018-6318 or the next vulnerability affects your stack