CVE-2017-20227

critical · 9.3

JAD Java Decompiler 1.5.8e-1kali1 and prior contains a stack-based buffer overflow vulnerability that allows attackers to execute arbitrary code by supplying overly long input that exceeds buffer boundaries. Attackers can craft malicious input passed to the jad command to overflow the stack and execute a return-oriented programming chain that spawns a shell.

9.3

CVSS

0.7%

EPSS (exploit prob.)

50th

EPSS percentile

2026-03-28

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-787

Affected products

Vendor	Product	Affected versions
varaneckas	jad_java_decompiler	1.5.8e-1kali1

Check a specific version with /api/v1/cve/match.

References

http://www.varaneckas.com/jad/
https://www.exploit-db.com/exploits/42255
https://www.vulncheck.com/advisories/jad-8e-1kali1-stack-based-buffer-overflow

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2017-20227