CVE-2018-12098: Liblnk Project Liblnk

Medium severity, CVSS 5.5. EPSS: 0.6% chance of exploitation in the next 30 days.

The liblnk_data_block_read function in liblnk_data_block.c in liblnk through 2018-04-19 allows remote attackers to cause an information disclosure (heap-based buffer over-read) via a crafted lnk file. NOTE: the vendor has disputed this as described in libyal/liblnk issue 33 on GitHub

Affected products

• Liblnk Project Liblnk: up to and including 20180419

Published 2018-06-19. Last modified 2026-06-17.