Bochs 2.6-5 contains a stack-based buffer overflow vulnerability that allows attackers to execute arbitrary code by supplying an oversized input string to the application.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Mar 28, 2026 · NIST NVD

   Detected

   Bochs 2.6-5 contains a stack-based buffer overflow vulnerability that allows attackers to execute arbitrary code by supplying an oversized input string to the application. Attackers can craft a malicious payload with 1200 bytes of padding followed by a return-oriented programming chain to overwrite the instruction pointer and execute shell commands with application privileges.

2. Jun 17, 2026 · NIST NVD

   Updated

   Bochs 2.6-5 contains a stack-based buffer overflow vulnerability that allows attackers to execute arbitrary code by supplying an oversized input string to the application. Attackers can craft a malicious payload with 1200 bytes of padding followed by a return-oriented programming chain to overwrite the instruction pointer and execute shell commands with application privileges.

Affected

• cpe bochs project/bochs2.6.5

Sources

• CVE.orgVulnerability recordCVE-2018-25220

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2018-25220

  Bochs 2.6-5 contains a stack-based buffer overflow vulnerability that allows attackers to execute arbitrary code by supplying an oversized input string to the application. Attackers can craft a malicious payload with 1200 bytes of padding followed by a return-oriented programming

  nvd.nist.gov

References

• Product · bochs.sourceforge.net
• Exploit · exploit-db.com
• Third Party Advisory · vulncheck.com