CVE-2018-12096: Liblnk Project Liblnk

Medium severity, CVSS 5.5. EPSS: 0.6% chance of exploitation in the next 30 days.

The liblnk_data_string_get_utf8_string_size function in liblnk_data_string.c in liblnk through 2018-04-19 allows remote attackers to cause an information disclosure (heap-based buffer over-read) via a crafted lnk file. NOTE: the vendor has disputed this as described in libyal/liblnk issue 33 on GitHub

Affected products

• Liblnk Project Liblnk: up to and including 20180419

Published 2018-06-19. Last modified 2026-06-17.