TI-2018-00078 Aliases CVE-2018-0103 GHSA-xjqv-vp4w-g4g9

Memory corruption in Cisco WebEx Network Recording Player

LOW 39CWE-119Published 2018-01-04 · Updated 2024-12-02

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.

Summary

A Buffer Overflow vulnerability in Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) files could allow a local attacker to execute arbitrary code on the system of a user. The attacker could exploit this vulnerability by sending the user a link or email attachment with a malicious ARF file and persuading the user to follow the link or launch the file. Successful exploitation could allow the attacker to execute arbitrary code on the user's system. This vulnerability affects Cisco WebEx Business Suite meeting sites, Cisco WebEx Meetings sites, Cisco WebEx Meetings Server, and Cisco WebEx ARF players. Cisco Bug IDs: CSCvg78835, CSCvg78837, CSCvg78839.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01715 77th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	Cisco WebEx Network Recording Player	Cisco WebEx Network Recording Player	—	No fix listed	CNA

Cisco WebEx Network Recording Player Vendor— Affected Cisco WebEx Network Recording Player Fixed in — No fix listed CNA

CPE configurations NVD · 4

CPE	Versions	Role	Vendor
cpe:2.3:a:cisco:webex_business_suite:-:::::::*	not specified by NVD	Vulnerable	Cisco
cpe:2.3:a:cisco:webex_meetings:-:::::::*	not specified by NVD	Vulnerable	Cisco
cpe:2.3:a:cisco:webex_meetings_server:-:::::::*	not specified by NVD	Vulnerable	Cisco
cpe:2.3:a:cisco:webex_network_recording_player:-:::::::*	not specified by NVD	Vulnerable	Cisco

cpe:2.3:a:cisco:webex_business_suite:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco
cpe:2.3:a:cisco:webex_meetings:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco
cpe:2.3:a:cisco:webex_meetings_server:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco
cpe:2.3:a:cisco:webex_network_recording_player:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2018-0103
2026-10-03 Alias added: GHSA-xjqv-vp4w-g4g9

References

Advisory 1

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180103-wnrp

TI-2018-00079 Improper input validation in Cisco WebEx Advanced Recording Format Player CVSS 3.0CRITICAL 9.6
TI-2018-00338 Memory corruption in Cisco Webex Network Recording Players unknown CVSS 3.0HIGH 7.8
TI-2019-11397 Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities CVSS 3.1HIGH 7.8
TI-2019-11395 Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities CVSS 3.1HIGH 7.8
TI-2019-01549 Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities CVSS 3.1HIGH 7.8
TI-2019-01548 Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities CVSS 3.1HIGH 7.8

See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences