CVE-2018-25253
Buffer Overflow in Termite 3.4 UI Language Causes DoS
Publication date: 2026-04-04
Last updated on: 2026-04-27
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| compuphase | termite | to 3.4 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of CVE-2018-25253 on compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
CVE-2018-25253 is a buffer overflow vulnerability in Termite version 3.4, specifically in the User interface language settings field. Local attackers can exploit this by inputting an excessively long string—such as a 2000-byte payload—into this field, which causes the application to crash or become unresponsive, resulting in a denial of service (DoS). This happens because the application does not properly validate or limit the length of the input, leading to an out-of-bounds write.
How can this vulnerability impact me? :
The primary impact of this vulnerability is a denial of service condition. An attacker with local access can crash the Termite application by supplying a very long string in the User interface language settings field, causing the program to become unresponsive or terminate unexpectedly. This disrupts normal operation and availability of the software.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by attempting to reproduce the denial of service condition on Termite 3.4 by inputting an excessively long string into the User interface language settings field.
A proof-of-concept method involves running a Python script that generates a 2000-character payload (e.g., 2000 'A's) written to a file, then copying and pasting this payload into the User interface language field within Termite's settings. Applying this input causes the application to crash or become unresponsive, confirming the presence of the vulnerability.
The Python script example to generate the payload is as follows:
- python -c "print('A'*2000)" > boom.txt
After running this command, open the generated 'boom.txt' file, copy its contents, and paste it into the User interface language field in Termite 3.4 settings to test for the crash.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include avoiding the use of excessively long strings in the User interface language settings field of Termite 3.4.
Since the vulnerability requires local access to the application, restricting access to trusted users and environments can reduce risk.
Additionally, consider updating or patching Termite if a fixed version is available, or applying any vendor-recommended workarounds to prevent buffer overflow conditions.
If no patch is available, refrain from modifying the User interface language setting with untrusted or unusually long input.