Arm Whois 3.11 contains a buffer overflow vulnerability that allows local attackers to execute arbitrary code by overwriting the structured exception handler. A…

CVE-2018-25432 affects Arm Whois version 3.11, containing a buffer overflow vulnerability that enables local attackers to execute arbitrary code. The vulnerability is exploited by overwriting the structured exception handler (SEH) through a malicious input file. Attackers can craft input with a specific 672-byte offset to overwrite nSEH and SEH pointers. This enables code execution through exception handler hijacking techniques. The vulnerability allows local privilege escalation and arbitrary code execution on affected systems.