CVE-2018-7054 — irssi: use-after-free when a server is disconnected during netsplits

Back Back to CVE browser

CRITICAL

irssi: use-after-free when a server is disconnected during netsplits

Published Feb 15, 2018

9.8

CRITICAL

CVSS 3.0

EPSS 2.38%

Description

An issue was discovered in Irssi before 1.0.7 and 1.1.x before 1.1.1. There is a use-after-free when a server is disconnected during netsplits. NOTE: this issue exists because of an incomplete fix for CVE-2017-7191.

Affected products

Red Hat Enterprise Linux 6

irssi

Not affected
Red Hat Enterprise Linux 7

irssi

Not affected
Red Hat Enterprise Linux 8

irssi

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 6	irssi	Not affected	n/a
Red Hat Enterprise Linux 7	irssi	Not affected	n/a
Red Hat Enterprise Linux 8	irssi	Not affected	n/a

Remediation

Red Hat statement

This issue did not affect the versions of Irssi as shipped with Red Hat Enterprise Linux 6 and 7, since the affected code was introduced in Irssi version 1.0.0.

Metrics

2.38% 0.02383

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 2, 2026.

EPSS probability 0.02383

Score over time

2021–2026

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (18 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 2, 2026	2.38% (0.02383)	83.32th	v5 (v2026.06.15)
Jun 15, 2026	2.47% (0.02467)	82.34th	v5 (v2026.06.15)
Mar 30, 2025	0.85% (0.00849)	72.75th	v4 (v2025.03.14)
Mar 29, 2025	2.45% (0.02450)	75.30th	v4 (v2025.03.14)
Jul 20, 2024	0.40% (0.00397)	73.75th	v3 (v2023.03.01)
Feb 8, 2024	0.40% (0.00397)	72.82th	v3 (v2023.03.01)
Sep 11, 2023	0.40% (0.00397)	70.27th	v3 (v2023.03.01)
Aug 18, 2023	0.43% (0.00435)	71.45th	v3 (v2023.03.01)
Jul 9, 2023	0.45% (0.00446)	71.52th	v3 (v2023.03.01)
Mar 7, 2023	0.44% (0.00437)	70.74th	v3 (v2023.03.01)
Mar 6, 2023	1.02% (0.01018)	40.69th	v2 (v2022.01.01)
Sep 10, 2022	1.02% (0.01018)	38.88th	v2 (v2022.01.01)
Apr 1, 2022	1.02% (0.01018)	36.86th	v2 (v2022.01.01)
Feb 4, 2022	1.02% (0.01018)	19.50th	v2 (v2022.01.01)
Feb 3, 2022	1.25% (0.01247)	30.57th	v1
Jan 6, 2022	1.25% (0.01247)	29.93th	v1
Sep 1, 2021	1.25% (0.01247)	68.62th	v1
Apr 14, 2021	1.25% (0.01247)	0.00th	v1

Weaknesses (1)

CWE-416

Use After Free

References (9)

http://openwall.com/lists/oss-security/2018/02/15/1
x_refsource_CONFIRMMailing List
https://access.redhat.com/security/cve/CVE-2018-7054
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1546223
Issue Tracking
https://irssi.org/security/irssi_sa_2018_02.txt
x_refsource_CONFIRMMitigationVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-7054
https://usn.ubuntu.com/3590-1/
vendor-advisoryx_refsource_UBUNTUThird Party Advisory
https://usn.ubuntu.com/4046-1/
vendor-advisoryx_refsource_UBUNTU
https://www.cve.org/CVERecord?id=CVE-2018-7054
https://www.debian.org/security/2018/dsa-4162
vendor-advisoryx_refsource_DEBIANThird Party Advisory

Link	Providers	Tags
http://openwall.com/lists/oss-security/2018/02/15/1		x_refsource_CONFIRMMailing List
https://access.redhat.com/security/cve/CVE-2018-7054		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1546223		Issue Tracking
https://irssi.org/security/irssi_sa_2018_02.txt		x_refsource_CONFIRMMitigationVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-7054
https://usn.ubuntu.com/3590-1/		vendor-advisoryx_refsource_UBUNTUThird Party Advisory
https://usn.ubuntu.com/4046-1/		vendor-advisoryx_refsource_UBUNTU
https://www.cve.org/CVERecord?id=CVE-2018-7054
https://www.debian.org/security/2018/dsa-4162		vendor-advisoryx_refsource_DEBIANThird Party Advisory