CVE-2018-25282: Nmap 7.70 DoS Vulnerability via XML

CVE-2018-25282 Overview

CVE-2018-25282 is a denial of service vulnerability in Nmap 7.70, specifically affecting the Zenmap graphical front-end. The flaw allows a local attacker to crash the application by importing a crafted XML scan file that contains nested entity definitions. When Zenmap parses the file, exponential entity expansion (a "billion laughs" style attack) consumes excessive memory and CPU, rendering the application unresponsive. The vulnerability is categorized under [CWE-674] Uncontrolled Recursion.

Critical Impact
Successful exploitation crashes Zenmap and exhausts local system resources, disrupting reconnaissance and scan-review workflows on the affected host.

Affected Products

Nmap 7.70 (Windows installer distribution)
Zenmap GUI bundled with Nmap 7.70
Systems importing third-party Nmap XML scan results into Zenmap 7.70

Discovery Timeline

2026-04-26 - CVE-2018-25282 published to the National Vulnerability Database
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2018-25282

Vulnerability Analysis

Nmap stores and exchanges scan results in XML format. Zenmap, the official GUI for Nmap, parses these XML files when a user imports a previous scan. The XML parser used in Nmap 7.70 expands document type definition (DTD) entities without bounds checking. An attacker who supplies an XML file with chained entity definitions triggers exponential expansion during parsing. The resulting allocation pattern consumes available memory and CPU until the Zenmap process terminates or the host becomes unresponsive.

The issue requires local interaction because the attacker must convince a user to open the malicious file through Zenmap's scan import feature. Exploitation does not yield code execution or data disclosure. Impact is restricted to availability of the Zenmap process and, in resource-constrained environments, the host operating system.

Root Cause

The root cause is the absence of entity expansion limits in the XML parser invoked by Zenmap. The parser resolves nested entity references recursively, and each level multiplies the size of the expanded string. With a small input file containing a handful of nested definitions, expansion grows to gigabytes of memory pressure, matching the classic uncontrolled recursion pattern described by [CWE-674].

Attack Vector

The attack vector is local. An attacker crafts an Nmap-formatted XML file containing recursive entity definitions and delivers it to the target through email, a shared network folder, or a download link. The victim opens the file using Zenmap's "Open Scan" import feature. Parsing begins immediately, expansion grows uncontrolled, and the application freezes or terminates. No authentication or network access to the target is required beyond convincing the user to open the file.

A technical proof of concept is documented in Exploit-DB #45357 and the VulnCheck Nmap DoS Advisory.

Detection Methods for CVE-2018-25282

Indicators of Compromise

Zenmap process consuming abnormal amounts of memory or CPU shortly after a user opens an .xml scan file
Unexpected Zenmap crashes correlated with imports of externally sourced XML files
Presence of XML files containing nested <!ENTITY> declarations referencing other internal entities

Detection Strategies

Inspect XML scan files for recursive entity definitions before they are opened with Zenmap
Monitor endpoint telemetry for zenmap.exe or python.exe (Zenmap wrapper) processes exhibiting runaway memory growth
Alert on file delivery channels (email gateways, file shares) where .xml attachments contain <!DOCTYPE declarations with multiple chained entity references

Monitoring Recommendations

Track installed Nmap versions across the estate and flag any host still running Nmap 7.70
Log Zenmap process termination events and resource utilization spikes for forensic review
Correlate user-initiated imports of XML scan data with abnormal child process behavior

How to Mitigate CVE-2018-25282

Immediate Actions Required

Upgrade Nmap and Zenmap to a version later than 7.70 on all affected hosts
Restrict Zenmap usage to trusted scan files generated internally
Remove the Nmap 7.70 Windows installer (nmap-7.70-setup.exe) from internal software repositories

Patch Information

No specific vendor advisory URL is listed in the published CVE record. Users should obtain the latest Nmap release from the official Nmap distribution site and replace the 7.70 installation. The original 7.70 Windows installer is referenced at Nmap Installation Executable for version identification purposes only.

Workarounds

Avoid opening XML scan results from untrusted sources in Zenmap
Review XML files in a text editor before importing to confirm no nested entity definitions are present
Use the nmap command-line interface instead of Zenmap for parsing third-party scan outputs
Run Zenmap inside a resource-limited sandbox or virtual machine to contain denial of service impact

bash

# Verify the installed Nmap version and remove vulnerable 7.70 builds
nmap --version

# On Windows, uninstall the 7.70 package silently
msiexec /x nmap-7.70-setup.exe /quiet

# On Linux, remove distribution-packaged Nmap before installing a current release
sudo apt-get remove --purge nmap