CVE-2018-6319: Sophos Tester

Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days.

In Sophos Tester Tool 3.2.0.7 Beta, the driver accepts a special DeviceIoControl code that doesn't check its argument. This argument is a memory address: if a caller passes a NULL pointer or a random invalid address, the driver will cause a Blue Screen of Death. If a program or malware does this at boot time, it can cause a persistent denial of service on the machine.

Affected products

• Sophos Sophos Tester: version 3.2.0.7 only

Published 2018-02-02. Last modified 2026-06-17.