Read the docs
TI-2018-03938 Aliases CVE-2018-5410GHSA-353c-4p9g-7m63

Dokan file system driver contains a stack-based buffer overflow

Priority LOW 37CWE-121Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.

Summary

Dokan, versions between 1.0.0.5000 and 1.2.0.1000, are vulnerable to a stack-based buffer overflow in the dokan1.sys driver. An attacker can create a device handle to the system driver and send arbitrary input that will trigger the vulnerability. This vulnerability was introduced in the 1.0.0.5000 version update.

Why it matters now

EPSS 0.01594 75th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Dokan, Inc.Open Source File System1.0.0.5000 and later; 1.2.0.1000 – 1.2.0.1000—No fix listedCNA
  • Open Source File System VendorDokan, Inc. Affected 1.0.0.5000 and later; 1.2.0.1000 – 1.2.0.1000 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:dokan-dev:dokany:*:*:*:*:*:*:*:*1.0.0.5000 to before 1.2.0.1000VulnerableDokan-dev
  • cpe:2.3:a:dokan-dev:dokany:*:*:*:*:*:*:*:* Versions 1.0.0.5000 to before 1.2.0.1000 Vulnerable ·Dokan-dev

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-5410
  2. 2026-10-03 Alias added: GHSA-353c-4p9g-7m63

References

Exploit 1

Patch 1

Advisory 2

  • TI-2022-03590 Dokan < 3.7.6 - Unauthenticated SQLi CVSS 3.1CRITICAL 9.8
  • TI-2024-03660 Dokan Pro <= 3.10.3 - Unauthenticated SQL Injection CVSS 3.1CRITICAL 10.0
  • TI-2022-02949 Dokan < 3.6.4 - Vendor Stored Cross-Site Scripting CVSS 3.1MEDIUM 5.4
  • TI-2026-19632 WordPress Dokan plugin <= 4.2.4 - Broken Authentication vulnerability CVSS 3.1HIGH 8.8
  • TI-2026-36689 WordPress Dokan plugin <= 5.0.2 - Privilege Escalation vulnerability CVSS 3.1HIGH 8.8
  • TI-2023-17212 WordPress Dokan Plugin <= 3.7.19 is vulnerable to PHP Object Injection CVSS 3.1HIGH 8.8
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences