CVE catalog

CVE-2018-5392

mingw-w64: CVE-2018-5392

Severity: Low
Published: Aug 14, 2018, 4:29:01 PM UTC
Source: [NVD] · [CVE record]
EPSS: 1.39% · Oct 25, 2026

mingw-w64 version 5.0.4 by default produces executables that opt in to ASLR, but are not compatible with ASLR. ASLR is an exploit mitigation technique used by modern Windows platforms. For ASLR to function, Windows executables must contain a relocations table. Despite containing the "Dynamic base" PE header, which indicates ASLR compatibility, Windows executables produced by mingw-w64 have the relocations table stripped from them by default. This means that executables produced by mingw-w64 are vulnerable to return-oriented programming (ROP) attacks. Windows executables generated by mingw-w64 claim to be ASLR compatible, but are not. Vulnerabilities in such executables are more easily exploitable as a result.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	mingw-w64	sid	`14.0.0-1`	vulnerable
Debian	mingw-w64	forky	`14.0.0-1`	vulnerable
Debian	mingw-w64	trixie	`12.0.0-5`	vulnerable
Debian	mingw-w64	bookworm	`10.0.0-3`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	mingw-w64	source	sid	`(unfixed)`	unimportant	Not reported	[968277]
Debian	mingw-w64	source	forky	`(unfixed)`	unimportant	Not reported	[968277]
Debian	mingw-w64	source	trixie	`(unfixed)`	unimportant	Not reported	[968277]
Debian	mingw-w64	source	bookworm	`(unfixed)`	unimportant	Not reported	[968277]

[Debian bug #968277]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[mingw-w64]Affected
Details (2)
- 10.0.0-3 · all · bookworm
  Affected
  dsa · mingw-w64 · debian · bookworm; dsa · mingw-w64 · debian · 12
- 10.0.0-3 · all · bookworm
  Affected
  dsa · mingw-w64 · debian · bookworm; dsa · mingw-w64 · debian · 12
[mingw-w64-common]Affected
Source package: [mingw-w64]
Details (2)
- 10.0.0-3 · all · bookworm
  Affected
  dsa · mingw-w64 · debian · bookworm; dsa · mingw-w64 · debian · 12
- 10.0.0-3 · all · bookworm
  Affected
  dsa · mingw-w64 · debian · bookworm; dsa · mingw-w64 · debian · 12
[mingw-w64-i686-dev]Affected
Source package: [mingw-w64]
Details (2)
- 10.0.0-3 · all · bookworm
  Affected
  dsa · mingw-w64 · debian · bookworm; dsa · mingw-w64 · debian · 12
- 10.0.0-3 · all · bookworm
  Affected
  dsa · mingw-w64 · debian · bookworm; dsa · mingw-w64 · debian · 12
[mingw-w64-tools]Affected
Source package: [mingw-w64]
Details (2)
- 10.0.0-3 · amd64 · bookworm
  Affected
  dsa · mingw-w64 · debian · bookworm; dsa · mingw-w64 · debian · 12
- 10.0.0-3 · arm64 · bookworm
  Affected
  dsa · mingw-w64 · debian · bookworm; dsa · mingw-w64 · debian · 12
[mingw-w64-x86-64-dev]Affected
Source package: [mingw-w64]
Details (2)
- 10.0.0-3 · all · bookworm
  Affected
  dsa · mingw-w64 · debian · bookworm; dsa · mingw-w64 · debian · 12
- 10.0.0-3 · all · bookworm
  Affected
  dsa · mingw-w64 · debian · bookworm; dsa · mingw-w64 · debian · 12

[Debian 13 (Trixie)]

[mingw-w64]Affected
Details (2)
- 12.0.0-5 · all · trixie
  Affected
  dsa · mingw-w64 · debian · 13
- 12.0.0-5 · all · trixie
  Affected
  dsa · mingw-w64 · debian · 13
[mingw-w64-common]Affected
Source package: [mingw-w64]
Details (2)
- 12.0.0-5 · all · trixie
  Affected
  dsa · mingw-w64 · debian · 13
- 12.0.0-5 · all · trixie
  Affected
  dsa · mingw-w64 · debian · 13
[mingw-w64-i686-dev]Affected
Source package: [mingw-w64]
Details (2)
- 12.0.0-5 · all · trixie
  Affected
  dsa · mingw-w64 · debian · 13
- 12.0.0-5 · all · trixie
  Affected
  dsa · mingw-w64 · debian · 13
[mingw-w64-tools]Affected
Source package: [mingw-w64]
Details (2)
- 12.0.0-5 · amd64 · trixie
  Affected
  dsa · mingw-w64 · debian · 13
- 12.0.0-5 · arm64 · trixie
  Affected
  dsa · mingw-w64 · debian · 13
[mingw-w64-ucrt64-dev]Affected
Source package: [mingw-w64]
Details (2)
- 12.0.0-5 · all · trixie
  Affected
  dsa · mingw-w64 · debian · 13
- 12.0.0-5 · all · trixie
  Affected
  dsa · mingw-w64 · debian · 13
[mingw-w64-x86-64-dev]Affected
Source package: [mingw-w64]
Details (2)
- 12.0.0-5 · all · trixie
  Affected
  dsa · mingw-w64 · debian · 13
- 12.0.0-5 · all · trixie
  Affected
  dsa · mingw-w64 · debian · 13

Observed: Oct 23, 2026, 5:37:19 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]