CVE-2018-25246 — Wikipedia 12.0 Denial of Service via Search · CoreCVE

Back Back to CVE browser

HIGH

Wikipedia 12.0 Denial of Service via Search

Published Apr 4, 2026

8.7

HIGH

CVSS 4.0

EPSS 0.36%

Description

Wikipedia 12.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the application by submitting oversized input through the search functionality. Attackers can paste a large buffer of repeated characters into the search bar to trigger an application crash.

Affected products

Vendor Wikipedia Product Wikipedia Default
n/a
- Version
  12.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Version	Status	Constraints
12.0	affected	-

Remediation

No remediation recorded yet.

Metrics

0.36% 0.00357

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00357

Score over time

Apr–Oct 2026

EPSS v4
EPSS v5

Percentile over time

EPSS v4
EPSS v5

Table of values (3 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.36% (0.00357)	27.10th	v5 (v2026.06.15)
Jun 15, 2026	0.36% (0.00357)	27.37th	v5 (v2026.06.15)
Apr 5, 2026	0.04% (0.00042)	12.77th	v4 (v2025.03.14)

Weaknesses (1)

CWE-306

Missing Authentication

References (2)

Link	Providers	Tags
https://www.exploit-db.com/exploits/45324		exploit
https://www.microsoft.com/en-us/p/wikipedia/9wzdncrfhwm4?activetab=pivot%3aoverviewtab		product

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner VulnCheck

Published Apr 4, 2026

Updated Apr 6, 2026

Reserved Apr 4, 2026

Link CVE-2018-25246

CISA Vulnrichment

Updated Apr 6, 2026

Status Deferred

Modified Jul 21, 2026

Link CVE-2018-25246

Severity n/a

Public date n/a

Links CVE-2018-25246