TI-2018-03006 Aliases CVE-2018-4038 GHSA-g3f8-q8cx-jm7w

An exploitable arbitrary write vulnerability exists in the open document format parser of…

LOW 37CWE-131Published 2018-12-01 · Updated 2024-09-16

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-131 and the CVSS impact.

Summary

An exploitable arbitrary write vulnerability exists in the open document format parser of the Atlantis Word Processor, version 3.2.7.2, while trying to null-terminate a string. A specially crafted document can allow an attacker to pass an untrusted value as a length to a constructor. This constructor will miscalculate a length and then use it to calculate the position to write a null byte. This can allow an attacker to corrupt memory, which can result in code execution under the context of the application. An attacker must convince a victim to open a specially crafted document in order to trigger this vulnerability.

Why it matters now

EPSS 0.01279 70th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Talos	Atlantis Word Processor	Atlantis Word Processor 3.2.7.1, 3.2.7.2	—	No fix listed	CNA

Atlantis Word Processor VendorTalos Affected Atlantis Word Processor 3.2.7.1, 3.2.7.2 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:atlantiswordprocessor:atlantis_word_processor:3.2.7.1:::::::*	3.2.7.1	Vulnerable	The Atlantis Word Processor Team
cpe:2.3:a:atlantiswordprocessor:atlantis_word_processor:3.2.7.2:::::::*	3.2.7.2	Vulnerable	The Atlantis Word Processor Team

cpe:2.3:a:atlantiswordprocessor:atlantis_word_processor:3.2.7.1:*:*:*:*:*:*:* Versions 3.2.7.1 Vulnerable ·The Atlantis Word Processor Team
cpe:2.3:a:atlantiswordprocessor:atlantis_word_processor:3.2.7.2:*:*:*:*:*:*:* Versions 3.2.7.2 Vulnerable ·The Atlantis Word Processor Team

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2018-4038
2026-10-03 Alias added: GHSA-g3f8-q8cx-jm7w

References

Exploit 1

https://talosintelligence.com/vulnerability_reports/TALOS-2018-0711

TI-2018-02946 Out-of-bounds write in Atlantis Word Processor CVSS 3.0HIGH 8.8
TI-2018-03007 Out-of-bounds write in Talos Atlantis Word Processor CVSS 3.1HIGH 7.8
TI-2018-02969 An exploitable uninitialized pointer vulnerability exists in the Office Open XML parser… CVSS 3.1HIGH 7.8
TI-2018-02952 Memory corruption in Atlantis Word Processor CVSS 3.1HIGH 7.8
TI-2018-02951 An exploitable uninitialized pointer vulnerability exists in the Word document parser of… CVSS 3.1HIGH 7.8
TI-2018-02950 Out-of-bounds write in Atlantis Word Processor CVSS 3.1HIGH 7.8

See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences