Denial of Service Vulnerability in Nmap 7.70 by Affected Vendor
CVE-2018-25282

6.9MEDIUM

Key Information:

Vendor

Zenmap

Status
Zenmap
Vendor
CVE Published:
26 April 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2018-25282?

Nmap 7.70 presents a vulnerability that enables local attackers to exploit the application by processing crafted XML files. This involves the use of nested entity definitions that, when opened through ZenMap's scan import feature, lead to excessive resource consumption and ultimately crash the program, compromising system stability.

Affected Version(s)

ZenMap 7.70

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2018-25282 - Proof of Concept

References

https://www.exploit-db.com/exploits/45357
exploit
https://nmap.org/dist/nmap-7.70-setup.exe
product
https://www.vulncheck.com/advisories/nmap-denial-of-servi...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Gionathan "John" Reale
.