CVE-2016-20049

critical · 9.3

JAD 1.5.8e-1kali1 and prior contains a stack-based buffer overflow vulnerability that allows attackers to execute arbitrary code by supplying oversized input that exceeds buffer boundaries. Attackers can craft malicious input strings exceeding 8150 bytes to overflow the stack, overwrite return addresses, and execute shellcode in the application context.

9.3

CVSS

0.7%

EPSS (exploit prob.)

50th

EPSS percentile

2026-03-28

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-787

Affected products

Vendor	Product	Affected versions
varaneckas	jad_java_decompiler	1.5.8e-1kali1

Check a specific version with /api/v1/cve/match.

References

http://www.varaneckas.com/jad/
https://www.exploit-db.com/exploits/42076
https://www.vulncheck.com/advisories/jad-8e-1kali1-stack-based-buffer-overflow-remote-code-execution

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2016-20049