CVE-2018-6331 - AskarLabs CVE Database

CVE-2018-6331

Vendor Facebook

Product Buck

Weakness CWE-502 · Unsafe deserialization

Published December 31, 2018

Last update May 6, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Buck parser-cache command loads/saves state using Java serialized object. If the state information is maliciously crafted, deserializing it could lead to code execution. This issue affects Buck versions prior to v2018.06.25.01.

Key dates

02Disclosure timeline

December 31, 2018 CVE published

May 6, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2018-6331 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/502.html

Related vulnerabilities

04Related CVE

CVE-2026-26221 Hyland OnBase Timer Service Unauthenticated .NET Remoting RCE CVE-2026-25769 Wazuh Cluster vulnerable to Remote Code Execution via Insecure Deserialization CVE-2021-23894 Unauthorized deserialization of untrusted data in McAfee DBSec CVE-2025-13713 Tencent Hunyuan3D-1 load_pretrained Deserialization of Untrusted Data Remote Code Execution Vulnerability CVE-2025-42928 Deserialization Vulnerability in SAP jConnect - SDK for ASE

Identifiers

CVE CVE-2018-6331

CWE CWE-502

Affected versions

Vendor Facebook

Product Buck

Affected v2018.06.25.01

Vendor Facebook

Product Buck

Affected ≥ unspecified and ≤ v2018.06.25.01