CVE-2017-14627 EXPLOIT
7.8
HIGH · CVSS 3.0 · EPSS 19% (pctl 97)
Patch early
A public exploit exists.
Description
Stack-based buffer overflows in CyberLink LabelPrint 2.5 allow remote attackers to execute arbitrary code via the (1) author (inside the INFORMATION tag), (2) name (inside the INFORMATION tag), (3) artist (inside the TRACK tag), or (4) default (inside the TEXT tag) parameter in an lpp project file.
Scoring
| CVSS | 7.8 (HIGH, v3.0) |
|---|---|
| Vector | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| EPSS | 19.02% — more likely to be exploited than 97% of all CVEs |
| Weakness | CWE-119 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2017-09-23 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| cyberlink | labelprint |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | CyberLink LabelPrint 2.5 - Stack Buffer Overflow (Metasploit) | 2018-12-13 |
| exploit-db | CyberLink LabelPrint < 2.5 - Local Buffer Overflow (SEH Unicode) | 2017-09-23 |
References
- https://blog.spentera.com/2017/09/19/unicode-stack-based-buffer-overflow-on-cyberlink-labelprint-2-5/
- https://www.exploit-db.com/exploits/42777/
- https://www.exploit-db.com/exploits/45985/
- https://blog.spentera.com/2017/09/19/unicode-stack-based-buffer-overflow-on-cyberlink-labelprint-2-5/
- https://www.exploit-db.com/exploits/42777/
- https://www.exploit-db.com/exploits/45985/
→ the Explorer · watch your stack · NVD