CVE-2016-20049

JAD 1.5.8e-1kali1 Stack-Based Buffer Overflow Remote Code Execution

JAD 1.5.8e-1kali1 and prior contains a stack-based buffer overflow vulnerability that allows attackers to execute arbitrary code by supplying oversized input that exceeds buffer boundaries. Attackers can craft malicious input strings exceeding 8150 bytes to overflow the stack, overwrite return addresses, and execute shellcode in the application context.

Affected

Varaneckas · JAD Java Decompiler

CVSS v4.0 VULNCHECK

9.3 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 VULNCHECK

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.67% chance of exploitation in the next 30 days, 51st percentile

Published

2026-03-28

Updated

2026-03-30

Proof-of-concept exploits (1)

• https://www.exploit-db.com/exploits/42076

Security advisories

• https://www.vulncheck.com/advisories/jad-8e-1kali1-stack-based-buffer-overflow-remote-cod…
• http://www.varaneckas.com/jad

References

• CVE Record
• NVD entry