CVE-2018-18820: Icecast URL-authentication backend buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityRemote, unauthenticated buffer overflow with potential code execution and a high EPSS score, though exploitation requires the URL-authentication backend to be enabled and the CVSS vector indicates high attack complexity.

What it is

Icecast before 2.4.4 contains a buffer overflow in its URL-authentication backend. When that backend is enabled, a malicious HTTP client can trigger the flaw by sending a request for a specific resource with a crafted header. The result is denial of service and potentially remote code execution.

Impact

An unauthenticated remote attacker can crash the Icecast service and may be able to execute arbitrary code in the context of the Icecast process.

Attack surface

Reachable over the network via HTTP requests to the affected resource; no authentication or user interaction is required, though the URL-authentication backend must be enabled and the CVSS vector notes high attack complexity.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged in the record, but EPSS is high at roughly 0.49 (98.8th percentile), indicating elevated likelihood of exploitation activity.

What to do

• Upgrade Icecast to 2.4.4 or later, which contains the fix.
• If immediate upgrade is not possible, disable the URL-authentication backend until patched.
• Apply vendor patches for Debian and Gentoo packages as referenced in the advisories.
• Restrict network access to Icecast management and authentication endpoints to trusted sources.
• Monitor Icecast for crashes or unexpected process restarts and investigate promptly.

Detection

• Inspect Icecast and web server logs for malformed or unusually long authentication-related headers.
• Alert on Icecast process crashes or restarts that correlate with HTTP requests to the authentication resource.
• Use network monitoring to flag oversized or anomalous headers sent to Icecast endpoints.
• Track for post-exploitation behavior such as unexpected child processes or outbound connections from the Icecast host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.