CVE-2018-1083: Buffer Overflow
Last updated 25 August 2025
Other sources
Zsh before version 5.4.2-test-1 is vulnerable to a buffer overflow in the shell autocomplete functionality. A local unprivileged user can create a specially crafted directory path which leads to code execution in the context of the user who tries to use autocomplete to traverse the before mentioned path. If the user affected is privileged, this leads to privilege escalation.
— Launchpad
zsh is vulnerable to a stack-based buffer overflow in the genmatchesfiles() function. A local attacker could exploit this through tab completion of directories with long names leading to arbitrary code execution.
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2018-1083?
CVE-2018-1083 is a vulnerability in Zsh before version 5.4.2-test-1 that allows a local unprivileged user to execute arbitrary code through a buffer overflow in the shell autocomplete functionality.
How severe is CVE-2018-1083?
CVE-2018-1083 has a severity rating of 7.8 (high).
Which software versions are affected by CVE-2018-1083?
Zsh versions up to and excluding 5.1.1-1ubuntu2.2, 5.2-5ubuntu1.2, 5.5, 5.7.1-1+deb10u1, 5.8-6+deb11u1, 5.9-4, and 5.9-5 are affected by CVE-2018-1083.
How can I fix CVE-2018-1083?
To fix CVE-2018-1083, update Zsh to version 5.4.2-test-1 or later.
Where can I find more information about CVE-2018-1083?
You can find more information about CVE-2018-1083 at the following references: [1] [2]