CVE-2018-25367: NASA openVSP Buffer Overflow Vulnerability

CVE-2018-25367 Overview

CVE-2018-25367 is a buffer overflow vulnerability [CWE-120] in NASA OpenVSP version 3.16.1. OpenVSP is an open-source parametric aircraft geometry tool maintained by NASA. The flaw exists in the Geom browser pod addition interface, where the geometry name input field fails to enforce length restrictions on user-supplied strings.

A local attacker can paste an excessively long string (approximately 5,000 bytes) into the name field to trigger an application crash. The condition results in a denial of service against the OpenVSP process. The vulnerability requires local interaction with the application but no authentication.

Critical Impact
Local attackers can crash NASA OpenVSP 3.16.1 by submitting a 5,000-byte string in the geometry name field, resulting in loss of application availability and any unsaved engineering work.

Affected Products

NASA OpenVSP 3.16.1
Geom browser pod addition interface (geometry name input field)
Installations on Windows, macOS, and Linux running the affected release

Discovery Timeline

2018-08-28 - Proof-of-concept published as Exploit-DB entry #45281
2026-05-25 - CVE-2018-25367 published to NVD
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2018-25367

Vulnerability Analysis

The vulnerability resides in the input handling logic of OpenVSP's Geom browser, specifically the pod addition workflow. When a user adds a new geometry component, the application exposes a name input field tied to a fixed-size internal buffer. The field accepts arbitrary user input without enforcing an upper bound on string length.

Supplying a string of roughly 5,000 bytes overflows the destination buffer and corrupts adjacent memory. The corruption causes OpenVSP to terminate abnormally rather than achieve controlled execution. The flaw is categorized under [CWE-120] (Classic Buffer Copy without Checking Size of Input).

Because the input vector is a GUI field that requires user interaction with the running application, the impact is restricted to availability. The reported research and proof-of-concept describe the condition strictly as a denial of service, not as a path to code execution.

Root Cause

The root cause is missing bounds checking on a string copy operation in the geometry name handler. The application allocates a fixed-size buffer for the component name and copies user-controlled data into it without validating length. No input sanitization or truncation is applied at the UI layer before the string reaches the underlying buffer.

Attack Vector

Exploitation requires local access to a session running OpenVSP 3.16.1. An attacker, or a user tricked into pasting a crafted string from a project template or shared file, opens the Geom browser, initiates a pod addition, and submits the oversized name. The application crashes, terminating any in-memory model state that has not been saved. The original proof-of-concept is available at Exploit-DB #45281.

Detection Methods for CVE-2018-25367

Indicators of Compromise

Unexpected termination of the vsp or vspaero process shortly after user interaction with the Geom browser
Operating system crash dumps or Windows Error Reporting entries referencing OpenVSP 3.16.1
OpenVSP project files (.vsp3) containing component names with abnormally long string values

Detection Strategies

Inventory engineering workstations for installations of OpenVSP 3.16.1 and earlier and flag them for upgrade
Scan shared .vsp3 model files for component name fields exceeding a reasonable length (for example, 256 characters)
Correlate repeated OpenVSP process crashes on the same host with recent file opens or clipboard activity

Monitoring Recommendations

Enable application crash logging on hosts running OpenVSP and forward events to a central log store
Monitor file shares and source repositories that distribute OpenVSP project files for anomalously large name attributes
Track endpoint process termination events for vsp.exe to identify clusters of crashes that may indicate intentional disruption

How to Mitigate CVE-2018-25367

Immediate Actions Required

Upgrade NASA OpenVSP to the latest release available from the NASA OpenVSP GitHub repository
Restrict OpenVSP execution to trusted users on engineering workstations and avoid opening untrusted .vsp3 files
Save work frequently when using affected versions to reduce data loss from a crash

Patch Information

No vendor-specific patch identifier is published in the NVD record for CVE-2018-25367. Users should obtain the most recent OpenVSP release from the official OpenVSP GitHub repository and review the VulnCheck advisory for current remediation guidance. Versions newer than 3.16.1 should be validated against the proof-of-concept input before redeployment.

Workarounds

Avoid pasting unvalidated text from external sources into the geometry name field
Sanitize shared OpenVSP project files by truncating overly long name fields before opening
Run OpenVSP under a standard user account so that a crash cannot affect other system services

bash

# Example: scan shared OpenVSP project files for oversized name attributes
grep -rEho 'Name="[^"]{256,}"' /path/to/openvsp/projects/ \
  | awk '{ print length, $0 }' \
  | sort -nr \
  | head