---
id: CVE-2018-25223
title: >-
  Crashmail 1.6 contains a stack-based buffer overflow vulnerability that allows
  remote attackers to execute arbitrary code by sending malicious input to the
  application
summary: >-
  Crashmail 1.6 contains a stack-based buffer overflow vulnerability that allows
  remote attackers to execute arbitrary code by sending malicious input to the
  application. Attackers can craft payloads with ROP chains to achieve code
  executi…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-787
vendor: ftnapps
product: crashmail_ii
affected:
  - crashmail_ii <= 1.6
published: '2026-03-28'
updated: '2026-10-07'
sourceUpdated: '2026-10-07T08:10:00.200'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2018-25223'
references:
  - url: 'http://exploitpack.com'
    label: disclosure@vulncheck.com
  - url: 'http://ftnapps.sourceforge.net/crashmail.html'
    label: disclosure@vulncheck.com
  - url: 'https://www.exploit-db.com/exploits/44331'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/crashmail-stack-based-buffer-overflow-remote-code-execution
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.0094
epssPercentile: 0.6076
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-04-01T14:03:21.930439Z'
ingestedAt: '2026-10-01T23:03:32.846Z'
---

## Overview

Crashmail 1.6 contains a stack-based buffer overflow vulnerability that allows remote attackers to execute arbitrary code by sending malicious input to the application. Attackers can craft payloads with ROP chains to achieve code execution in the application context, with failed attempts potentially causing denial of service.

## Affected

- `crashmail_ii <= 1.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.