CVE-2018-8754: Debian Linux

Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days.

The libevt_record_values_read_event() function in libevt_record_values.c in libevt before 2018-03-17 does not properly check for out-of-bounds values of user SID data size, strings size, or data size. NOTE: the vendor has disputed this as described in libyal/libevt issue 5 on GitHub

Affected products

• Debian Debian Linux: version 9.0 only
• Libevt Project Libevt: before 20180317 (fixed in 20180317)

Published 2018-03-18. Last modified 2026-06-17.