CVE-2018-25376 Overview
CVE-2018-25376 is a buffer overflow vulnerability in Socusoft 3GP Photo Slideshow version 8.05. The flaw exists in the application's registration dialog, where input supplied to the Registration Name and Registration Key fields is copied into a fixed-size stack buffer without bounds checking. A local attacker can overwrite the Structured Exception Handler (SEH) chain and redirect execution to attacker-controlled shellcode. Public exploit code demonstrates reverse shell access on the target host. The vulnerability is classified as [CWE-120] Buffer Copy without Checking Size of Input.
Critical Impact
Local attackers can execute arbitrary code in the context of the user running 3GP Photo Slideshow by supplying crafted registration input that hijacks SEH-based exception handling.
Affected Products
- Socusoft 3GP Photo Slideshow 8.05
- Registration dialog input handlers (Registration Name, Registration Key fields)
- Windows builds shipped via the vendor's DVD Photo Slideshow product line
Discovery Timeline
- 2026-05-25 - CVE-2018-25376 published to NVD
- 2026-05-26 - Last updated in NVD database
Technical Details for CVE-2018-25376
Vulnerability Analysis
The vulnerability resides in the registration dialog of 3GP Photo Slideshow 8.05. The application copies user-controlled strings from the registration form into a stack buffer without validating the length of the input. When the input exceeds the buffer boundary, adjacent stack data including the SEH record gets overwritten.
By crafting a string of sufficient length, an attacker can replace the saved Next SEH pointer and SEH Handler address. Triggering an exception after the overflow causes Windows to dispatch to the attacker-controlled handler, transferring execution to shellcode placed in the buffer. According to the Exploit-DB #45352 entry, a working proof of concept demonstrates a reverse shell payload.
Root Cause
The root cause is the absence of bounds checking on string copies performed during processing of the registration form fields. The vulnerable code path uses an unsafe copy operation into a fixed stack buffer, classified under [CWE-120]. The build does not enforce SafeSEH or SEHOP, allowing the SEH chain to be redirected to a non-validated address.
Attack Vector
Exploitation requires local interaction with the application. An attacker with the ability to run 3GP Photo Slideshow and submit input to the registration dialog can paste an oversized payload into the Registration Name or Registration Key field. The payload aligns shellcode within the buffer and overwrites the SEH record with a POP POP RET gadget pointing into a non-SafeSEH module. Once the exception is raised, control flow transfers to the attacker's shellcode. Additional technical details are available in the VulnCheck Advisory for Buffer Overflow.
Detection Methods for CVE-2018-25376
Indicators of Compromise
- Unexpected child processes spawned by the 3GP Photo Slideshow executable, particularly cmd.exe, powershell.exe, or network utilities
- Outbound TCP connections originating from the slideshow process to unfamiliar external hosts, indicative of reverse shell activity
- Application crash events in the Windows Event Log referencing access violations or SEH handler validation failures within the slideshow binary
Detection Strategies
- Monitor process creation telemetry for the 3GP Photo Slideshow binary spawning command interpreters or scripting hosts
- Inspect crash dumps from the application for overwritten SEH records and non-ASCII data in stack frames
- Apply behavioral rules that flag GUI applications initiating outbound socket connections to non-vendor infrastructure
Monitoring Recommendations
- Enable Windows Error Reporting and forward crash telemetry to a centralized log platform for triage
- Track installations of legacy multimedia utilities across the fleet using software inventory tooling
- Alert on registry or filesystem activity that indicates persistence following slideshow application execution
How to Mitigate CVE-2018-25376
Immediate Actions Required
- Remove Socusoft 3GP Photo Slideshow 8.05 from endpoints where it is not required for business operations
- Restrict execution of the application to non-privileged accounts and avoid running it on systems handling sensitive data
- Block outbound network connections from the slideshow executable using host-based firewall rules
Patch Information
No vendor patch is referenced in the available CVE data. Vendor information is published at the DVD Photo Slideshow Resource. Until a fixed release is confirmed, treat all installations of version 8.05 as vulnerable and prioritize removal or compensating controls.
Workarounds
- Uninstall the affected version and migrate to an actively maintained slideshow tool from a different vendor
- Enforce system-wide mitigations including Data Execution Prevention (DEP) and SEHOP via Windows Exploit Protection policies
- Apply application allowlisting to prevent the vulnerable binary from launching on production systems
# Enable SEHOP and DEP system-wide via PowerShell
Set-ProcessMitigation -System -Enable SEHOP,DEP
Set-ProcessMitigation -Name "3GPPhotoSlideshow.exe" -Enable SEHOP,DEP,BottomUp,ForceRelocateImages
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
