CVE-2018-25426

Vulnerability

WinMTR version 0.91 contains a buffer overflow vulnerability (CWE-120) in its file parsing routine. An attacker can trigger a denial of service by providing a specially crafted input file containing 238 bytes of repeated characters, causing the application to crash. The issue is present in the official release of WinMTR 0.91 [2].

Exploitation

An attacker can exploit this vulnerability by crafting a malicious payload file with 238 bytes of repeated characters and delivering it to the target system. No authentication or user interaction is required; the application crashes upon processing the malformed file, which can be delivered via network or local means [2].

Impact

Successful exploitation results in a denial of service, causing WinMTR to crash. There is no evidence of code execution or data compromise; the impact is limited to availability loss [2].

Mitigation

The vulnerability is fixed in WinMTR version 0.92, which is available for download from the official website [1]. Users should upgrade to the latest version. As a workaround, avoid opening untrusted input files with WinMTR 0.91. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.