CVE-2018-25224: 
Linux Debian vulnerability analysis and mitigation

CVE-2018-25224 is a stack-based buffer overflow vulnerability in PMS (Practical Music Search) version 0.42 that allows local attackers to execute arbitrary code by supplying malicious values in the application's configuration file. The vulnerability was assigned a CVSS v3.1 base score of 7.8 (High) and a CVSS v4.0 base score of 8.6 (High). It was published on March 28, 2026, and assigned by VulnCheck. Affected software is PMS (Practical Music Search) version 0.42 and earlier, developed by kimtore (VulnCheck Advisory, Exploit-DB).

The root cause is a stack-based buffer overflow (CWE-787: Out-of-bounds Write) in PMS 0.42's configuration file parser, which fails to perform adequate bounds checking on user-supplied input. An attacker with local access can craft a configuration file containing oversized input values that overflow the stack buffer, overwriting the return address and enabling control-flow hijacking. Exploitation is achieved via return-oriented programming (ROP) gadgets — specifically, the public proof-of-concept constructs a ROP chain using int 0x80 syscall gadgets to spawn /bin/sh. The attack requires low privileges and no user interaction, as the malicious configuration file is parsed automatically when PMS is launched (Exploit-DB, VulnCheck Advisory).

Successful exploitation allows a local low-privileged attacker to execute arbitrary code with the privileges of the PMS application process, resulting in high confidentiality, integrity, and availability impact on the affected system. An attacker can spawn an interactive shell, access sensitive data readable by the PMS process, modify files, or disrupt application availability. While the attack vector is local and scope is unchanged, privilege escalation or lateral movement may be possible depending on the permissions under which PMS runs (VulnCheck Advisory, Exploit-DB).

A complete, runnable Python proof-of-concept exploit is publicly available on Exploit-DB (EDB-44426), which constructs a ROP chain to achieve arbitrary code execution by overflowing the configuration file parser buffer and spawning /bin/sh via int 0x80 syscall gadgets. The exploit is assessed with high confidence as a real, functional exploit. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.016% (0.000160), indicating low probability of near-term exploitation. The vulnerability is detectable via Nessus plugin 304214 (Exploit-DB, Tenable).

1. Reconnaissance: Identify systems running PMS 0.42 or earlier. Confirm the application is installed and determine the path to its configuration file.
2. Craft malicious configuration file: Create a PMS configuration file with an oversized value in a vulnerable configuration field that exceeds the stack buffer's capacity, embedding a ROP chain payload (e.g., using int 0x80 syscall gadgets targeting /bin/sh).
3. Build ROP chain: Using the public Python exploit from Exploit-DB (EDB-44426), construct the ROP chain with gadgets from the PMS binary or linked libraries to redirect execution to a execve("/bin/sh", ...) syscall.
4. Trigger the overflow: Execute PMS with the crafted configuration file using pms -c <malicious_config>, causing the parser to overflow the stack buffer and transfer control to the ROP chain.
5. Achieve code execution: The ROP chain executes, spawning an interactive shell (/bin/sh) with the privileges of the PMS process (Exploit-DB).

• Process: Unexpected child processes spawned by the PMS binary (e.g., /bin/sh, bash) with the PMS process as parent.
• File System: Presence of unusual or modified PMS configuration files with abnormally large field values; unexpected files written by the PMS process.
• Logs: System logs (e.g., /var/log/auth.log, /var/log/syslog) showing shell activity initiated from the PMS process context; audit logs recording unexpected execve calls from the PMS binary.
• Network: Outbound network connections from the PMS process to unexpected remote hosts (if the attacker establishes a reverse shell post-exploitation).

No official patch is currently available for PMS 0.42. Recommended mitigations include: restricting write access to PMS configuration files to authorized users only; running PMS with the minimum required privileges (e.g., a dedicated low-privilege user account); implementing file integrity monitoring on PMS configuration files to detect unauthorized modifications; and monitoring for unexpected child processes spawned by PMS. Organizations should consider replacing or discontinuing use of PMS until a patched version is released (VulnCheck Advisory).

The vulnerability was assigned and disclosed by VulnCheck in March 2026, with a technical advisory published on their platform. A technical write-up was also published by Infinit Security. Community aggregators including VulDB, RedPacket Security, and CVE feed sites picked up the disclosure shortly after publication. No significant vendor statements or notable researcher commentary beyond the initial disclosure have been identified (VulnCheck Advisory, Infinit Security).