CVE-2018-25223: 
Linux Ubuntu vulnerability analysis and mitigation

CVE-2018-25223 is a stack-based buffer overflow vulnerability in Crashmail II version 1.6 (by ftnapps) that allows unauthenticated remote attackers to execute arbitrary code by sending malicious input to the application. Attackers can craft payloads using ROP (Return-Oriented Programming) chains to achieve code execution; failed attempts may result in denial of service. The vulnerability was formally published on March 28, 2026, and assigned by VulnCheck. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 9.3 (Critical) (VulnCheck Advisory, Exploit-DB).

The root cause is a stack-based buffer overflow (CWE-787: Out-of-bounds Write) in Crashmail II 1.6, triggered by insufficient bounds checking on attacker-controlled input processed by the application. An unauthenticated remote attacker can send specially crafted network input to overflow a stack buffer, overwriting the return address or control-flow data. Exploitation can leverage ROP chains to bypass common mitigations such as non-executable stack protections and achieve arbitrary code execution in the application's security context. A public exploit entry exists on Exploit-DB (EDB-44331), though its confirmed exploitability status is uncertain (VulnCheck Advisory, Exploit-DB).

Successful exploitation grants an unauthenticated remote attacker full code execution in the context of the Crashmail II process, resulting in high confidentiality, integrity, and availability impact. An attacker could read sensitive mail/FTN (Fidonet Technology Network) data, modify or destroy messages, or crash the application entirely. Depending on the privilege level of the running process, exploitation could potentially facilitate further lateral movement within the host system (VulnCheck Advisory).

A public exploit reference exists on Exploit-DB (EDB-44331), though its confirmed exploitability has not been independently verified and no active in-the-wild exploitation has been reported (Exploit-DB). The EPSS score is approximately 0.0026 (0.26%), indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified. The attack requires no privileges and no user interaction, making it trivially exploitable if the service is network-accessible (VulnCheck Advisory).

1. Reconnaissance: Identify hosts running Crashmail II 1.6 by scanning for the application's network-facing service ports or by querying internet-wide scan databases (e.g., Shodan, Censys) for ftnapps/Crashmail banners.
2. Craft malicious payload: Construct an oversized input buffer designed to overflow the vulnerable stack buffer in Crashmail II. Include a ROP chain to redirect execution flow, bypassing non-executable stack protections.
3. Deliver payload: Send the crafted input to the Crashmail II application over the network without any authentication or user interaction required.
4. Achieve code execution: If the ROP chain is correctly constructed for the target binary and environment, arbitrary code executes in the application's context. If the payload is malformed, the application crashes (denial of service).
5. Post-exploitation: Use the gained execution context to establish persistence, exfiltrate FTN/mail data, or pivot to other systems on the network (Exploit-DB, VulnCheck Advisory).

• Network: Unexpected or oversized input packets directed at the Crashmail II service port from external or untrusted IP addresses; unusual outbound connections from the Crashmail host to unknown external IPs following inbound traffic.
• Process: Unexpected child processes spawned by the Crashmail II process (e.g., shells, network utilities); application crashes or core dumps in the Crashmail working directory.
• File System: Presence of core dump files (core, crashmail.core) in the application directory; new or modified files in the Crashmail installation path created by the application process.
• Logs: Application error logs showing segmentation faults or abnormal termination; system logs (syslog, auth.log) recording unexpected process execution or privilege escalation events originating from the Crashmail service account.

No official patch from the vendor has been confirmed as available for Crashmail II 1.6. The primary recommended remediation is to upgrade to a version of Crashmail newer than 1.6 if one becomes available, or to replace the software with a maintained alternative. As an immediate workaround, restrict network access to the Crashmail service using firewall rules or network-level controls, limiting connectivity to trusted hosts only. Monitor network traffic to and from the Crashmail service for anomalous patterns indicative of exploitation attempts. Detection is available via Tenable Nessus plugin 304216 (Tenable Nessus, VulnCheck Advisory).

The vulnerability received limited public attention given the niche nature of Crashmail II (a Fidonet mailer). VulnCheck served as the assigning authority and published the advisory. Automated CVE tracking services (CIRCL, CVEFeed, VulDB, gcve.eu) indexed the vulnerability shortly after publication. No notable researcher commentary, vendor statements beyond the VulnCheck advisory, or significant media coverage has been identified (VulnCheck Advisory).