{"id":"CVE-2018-7289","url":"https://www.cyber-defence.io/tools/cve/CVE-2018-7289","generatedAt":"2026-10-28T19:05:50.671Z","title":"Malware with filenames containing pure UTF-16 characters can bypass detection.","description":"An issue was discovered in armadito-windows-driver/src/communication.c in Armadito 0.12.7.2. Malware with filenames containing pure UTF-16 characters can bypass detection. The user-mode service will fail to open the file for scanning after the conversion is done from Unicode to ANSI. This happens because characters that cannot be converted from Unicode are replaced with '?' characters.","published":"2018-02-21T18:29:00.000Z","lastModified":"2026-06-17T02:02:58.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.0","score":3.3,"severity":"LOW","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"},"cwe":["CWE-172"],"affected":["teclib-edition/armadito antivirus"],"epss":{"score":0.01723,"percentile":0.77381,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":1,"verified":false,"firstPublished":"2018-02-22","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":44169,"kind":"exploit","title":"Armadito Antivirus 0.12.7.2 - Detection Bypass","url":"https://www.exploit-db.com/exploits/44169","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/windows/local/44169.txt","file":"exploits/windows/local/44169.txt","published":"2018-02-22","added":"2018-02-22","updated":"2018-02-22","author":"Souhail Hammou","type":"local","platform":"windows","port":null,"verified":false,"codes":["CVE-2018-7289"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":null}]},"verdict":{"level":"high","text":"A public exploit is published in Exploit-DB, so the technical barrier is gone even though the severity is low and EPSS is 1.7%. Treat it as high on anything reachable from the internet."},"changes":[],"references":[{"url":"https://github.com/armadito/armadito-windows-driver/issues/5","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://www.exploit-db.com/exploits/44169/","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"cve@mitre.org"},{"url":"https://github.com/armadito/armadito-windows-driver/issues/5","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.exploit-db.com/exploits/44169/","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2018-7289","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}