Is CVE-2018-25367 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2018-25367 being exploited in the wild.

How severe is CVE-2018-25367?

Medium severity, with a CVSS score of 6.2, published 25 May 2026.

Is there a fix for CVE-2018-25367?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2018-25367 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2018-25367?

Check whether you run Nasa openVSP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2018-25367: NASA openVSP buffer overflow in geometry name field

CVE-2018-25367 · Severity: medium · CVSS 6.2 · Published 2026-05-25

NASA openVSP, a tool used for designing 3D aircraft models, is vulnerable to a flaw that can cause the application to crash. By entering an excessively long name for a design component, a user can trigger a memory error that shuts down the software. This results in a denial of service, potentially causing loss of unsaved engineering work or interrupting design operations.

Vendors: Nasa.

Quick answers

Is CVE-2018-25367 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2018-25367 being exploited in the wild.
How severe is CVE-2018-25367?: Medium severity, with a CVSS score of 6.2, published 25 May 2026.
Which products and versions are affected?: Nasa openVSP 3.16.1.
Is there a fix for CVE-2018-25367?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2018-25367 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2018-25367?: Check whether you run Nasa openVSP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A classic buffer overflow (CWE-120) exists in NASA openVSP version 3.16.1 due to insufficient input validation in the geometry name field. A local attacker can trigger this vulnerability by navigating to the 'Geom browser' interface and pasting a 5000-byte payload into the 'name' input field during the addition of a 'pod' component. This action causes a memory corruption that leads to an immediate application crash (Denial of Service). The vulnerability was demonstrated on Windows x86-64 platforms. While the repository was archived in 2018, users should be aware that no official patch is noted in the advisory for this legacy version.

Affected products

NASA openVSP 3.16.1

Timeline

2018-08-28: disclosed: Initial discovery and PoC by researcher L0RD
2018-08-29: other: Exploit published on Exploit-DB
2018-09-08: other: GitHub repository archived by owner
2026-05-25: advisory: CVE published/updated by VulnCheck and NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.