CVE-2018-25267: UltraISO Buffer Overflow Vulnerability

CVE-2018-25267 Overview

CVE-2018-25267 is a local buffer overflow vulnerability in UltraISO 9.7.1.3519, a disk image authoring tool developed by EZB Systems. The flaw resides in the Output FileName field of the Make CD/DVD Image dialog. An attacker who pastes a crafted filename containing 304 bytes of padding followed by Structured Exception Handler (SEH) overwrite values triggers a memory corruption condition. The application crashes, producing a denial of service. The issue is tracked under CWE-787: Out-of-bounds Write.

Critical Impact
Local attackers can crash UltraISO 9.7.1.3519 by overwriting SEH and SE handler records through the Output FileName field, producing a denial of service on the affected workstation.

Affected Products

EZB Systems UltraISO 9.7.1.3519
CPE: cpe:2.3:a:ezbsystems:ultraiso:9.7.1.3519:*:*:*:*:*:*:*
Windows installations running the vulnerable UltraISO build

Discovery Timeline

2026-04-22 - CVE-2018-25267 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2018-25267

Vulnerability Analysis

UltraISO 9.7.1.3519 fails to validate the length of user-supplied input in the Output FileName field of the Make CD/DVD Image dialog. When a string exceeding the expected buffer length is pasted into this field, the application writes past the destination buffer on the stack. The overflow reaches the SEH and SE handler records, overwriting the exception dispatcher chain.

The vulnerability is classified as an out-of-bounds write [CWE-787]. Exploitation requires local interaction with the UltraISO graphical interface. The current public proof of concept demonstrates a denial of service crash rather than arbitrary code execution. Modern Windows mitigations such as SafeSEH and SEHOP reduce the likelihood of reliable code execution through SEH overwrite on contemporary platforms.

Root Cause

The root cause is missing bounds checking on the Output FileName input handler. UltraISO copies the user-provided string into a fixed-size stack buffer without enforcing a maximum length. A payload of 304 bytes plus SEH overwrite data is sufficient to corrupt the exception handler structure for the current thread.

Attack Vector

Attack delivery is local and requires user interaction with the UltraISO interface. An attacker crafts a malicious filename string and convinces the user to paste it into the Output FileName field, or supplies it through a clipboard or file dialog interaction. The application then processes the string during the Make CD/DVD Image workflow and crashes.

No public exploit beyond the denial of service proof of concept is documented. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS data indicates a very low probability of observed exploitation activity.

For technical details and the published proof of concept, see Exploit-DB #45996 and the VulnCheck UltraISO Advisory.

Detection Methods for CVE-2018-25267

Indicators of Compromise

Unexpected crashes of UltraISO.exe accompanied by Windows Error Reporting events referencing access violations or SEH chain corruption
Application Event Log entries showing faulting module within UltraISO 9.7.1.3519 after interaction with the Make CD/DVD Image dialog
Crash dumps containing oversized strings in the Output FileName buffer region

Detection Strategies

Inventory endpoints to identify installations of UltraISO 9.7.1.3519 using software asset management or endpoint telemetry
Monitor for UltraISO.exe process termination events correlated with WerFault.exe invocations
Flag clipboard or scripted input operations that paste unusually long strings into UltraISO windows

Monitoring Recommendations

Forward Windows Application and Reliability logs to a central analytics platform for anomaly review
Track UltraISO process integrity and crash frequency across endpoints where the tool is authorized
Restrict execution of unauthorized UltraISO versions through application control policies

How to Mitigate CVE-2018-25267

Immediate Actions Required

Identify and inventory all systems running UltraISO 9.7.1.3519 and prioritize remediation on shared or multi-user workstations
Upgrade to the latest UltraISO release published on the UltraISO Official Website
Restrict use of UltraISO to trusted operators and disallow pasting untrusted filename strings into the Output FileName field

Patch Information

No vendor advisory is linked in the NVD record. Users should obtain the most recent UltraISO build from the UltraISO Official Website and verify the installed version is later than 9.7.1.3519. Refer to the VulnCheck UltraISO Advisory for additional remediation guidance.

Workarounds

Remove UltraISO 9.7.1.3519 from systems where disk image authoring is not required
Apply application control rules to block execution of the vulnerable build until an updated version is deployed
Train users to avoid pasting untrusted or attacker-supplied strings into the Make CD/DVD Image dialog

bash

# Configuration example: Windows application control to block vulnerable UltraISO build
New-AppLockerPolicy -RuleType Publisher -User Everyone -Action Deny `
  -FilePath "C:\Program Files (x86)\UltraISO\UltraISO.exe" `
  -Description "Block UltraISO 9.7.1.3519 (CVE-2018-25267)"