CVE-2025-1367

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A vulnerability was found in MicroWord eScan Antivirus 7.0.32 on Linux. It has been classified as critical. This affects the function sprintf of the component USB Password Handler. The manipulation leads to buffer overflow. An attack has to be approached locally. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-119 CWE-120

Affected software

Vendor	Product	Versions
MicroWord	eScan Antivirus	7.0.32

References

https://github.com/dmknght/FIS_RnD/blob/main/escan_av_usb_protection_multiple_vulns.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.295971Permissions Required, Third Party Advisory, VDB Entry
https://vuldb.com/?id.295971Third Party Advisory, VDB Entry
https://github.com/dmknght/FIS_RnD/blob/main/escan_av_usb_protection_multiple_vulns.mdExploit, Third Party Advisory

Timeline

Published: Feb 17, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-136706.7The High Level Synthesis Compiler i++ command for Windows is vulnerable to a DLL planting vulnerability CVE-2025-136716.5Cross-Site Request Forgery (CSRF) vulnerability in OpenText™ Web Site Management Server allows Cross Site Request Forgery. The vulnerability CVE-2025-136725.4Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in OpenText™ Web Site Management S CVE-2025-136737.5The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to SQL Injection via the 'coupon_code' parameter in CVE-2025-136745.5BPv7 dissector crash in Wireshark 4.6.0 allows denial of service CVE-2025-136759.8The Tiger theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 101.2.1. This is due to the 'paypa CVE-2025-136766.1The JustClick registration plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 0.1. T CVE-2025-136774.9The Simple Download Counter plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.2.2. This is due to CVE-2025-136786.4The Thai Lottery Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `thailottery` shortcode in all versions up CVE-2025-136796.5The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized access of data due to a missing capa CVE-2025-13682.3A vulnerability was found in MicroWord eScan Antivirus 7.0.32 on Linux. It has been declared as problematic. This vulnerability affects the CVE-2025-136808.8The Tiger theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 101.2.1. This is due to the plugin