CVE-2018-25322 Overview
CVE-2018-25322 is a stack-based buffer overflow in Allok Fast AVI MPEG Splitter version 1.2. The flaw resides in the application's License Name input field, which fails to enforce length checks before copying user-supplied data onto the stack. A local attacker can submit 780 bytes of padding followed by structured shellcode to overwrite the saved return address and redirect execution. Successful exploitation runs arbitrary code with the privileges of the user running the splitter. The weakness is tracked as [CWE-121] Stack-based Buffer Overflow.
Critical Impact
Local attackers can execute arbitrary code in the context of the Allok Fast AVI MPEG Splitter process by supplying a crafted license name string.
Affected Products
- Allok Fast AVI MPEG Splitter 1.2
- AllokSoft media tooling distributed from alloksoft.com
- Installations exposing the License Name registration field to untrusted input
Discovery Timeline
- 2026-05-17 - CVE-2018-25322 published to the National Vulnerability Database
- 2026-05-18 - Last updated in the NVD database
Technical Details for CVE-2018-25322
Vulnerability Analysis
The vulnerability lives in the registration routine that processes the License Name string entered through the application's user interface. The routine copies the supplied string into a fixed-size stack buffer without validating its length. When the input exceeds the buffer size, adjacent stack data, including the saved return address, is overwritten. An attacker who controls that return address can divert execution to attacker-supplied shellcode placed in the same input. Because the application runs locally with the privileges of the invoking user, successful exploitation produces local code execution rather than remote compromise. The issue is classified under [CWE-121] and assigned an EPSS score of 0.013%, reflecting limited mass-exploitation activity but a confirmed working proof of concept.
Root Cause
The root cause is the absence of bounds checking on the License Name field. The function consuming the input relies on an unsafe string copy that trusts caller-supplied data and writes into a stack buffer smaller than the attacker-controlled payload. No canary, ASLR-aware mitigation, or input length cap protects the affected routine in the shipped binary.
Attack Vector
Exploitation requires local access to a session running Allok Fast AVI MPEG Splitter 1.2. The attacker enters a payload containing 780 bytes of junk data followed by overwrite values for the saved EIP and a shellcode stub into the License Name field. When the application processes the field, the overflow occurs and control transfers to the shellcode. Technical proof-of-concept details are published as Exploit-DB #44341 and the VulnCheck Advisory for Allok. No verified code snippet is reproduced here; consult the linked advisories for byte-level layout.
Detection Methods for CVE-2018-25322
Indicators of Compromise
- Presence of the Allok Fast AVI MPEG Splitter 1.2 binary, typically installed from allok_vconverter.exe or related AllokSoft installers
- Unexpected child processes spawned by the splitter executable, such as command shells or script interpreters
- Application crashes referencing access violations near the registration or license-handling routines in Windows Event Viewer
Detection Strategies
- Hunt for process executions where the Allok splitter binary launches cmd.exe, powershell.exe, or other LOLBins, which is anomalous for a media-splitting utility
- Inspect Windows Error Reporting and crash dump artifacts for exception codes 0xC0000005 originating from the Allok process image
- Flag clipboard or scripted input automation that writes oversized strings into the License Name dialog of the affected application
Monitoring Recommendations
- Track installations of legacy AllokSoft products across the estate using software inventory data
- Alert on creation of new persistence artifacts, such as Run keys or scheduled tasks, by the splitter process
- Forward endpoint process and crash telemetry to a central data lake to correlate exploitation attempts across hosts
How to Mitigate CVE-2018-25322
Immediate Actions Required
- Uninstall Allok Fast AVI MPEG Splitter 1.2 from all endpoints where it is not business-critical
- Restrict execution of the binary using application control or AppLocker policies until removal is complete
- Limit interactive logon and shared-workstation access to reduce the local attack surface
Patch Information
No vendor patch is referenced in the available advisories. The VulnCheck Advisory for Allok and the AllokSoft Homepage do not list a fixed build for version 1.2. Treat the product as unsupported and plan removal or replacement with an actively maintained media tool.
Workarounds
- Run the application only under low-privilege accounts that cannot install software or modify system settings
- Block the splitter executable with software restriction policies in environments where uninstallation is delayed
- Prevent untrusted users from supplying arbitrary strings into the License Name dialog by removing shared or kiosk access
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
