# CVE-2018-13348: mercurial: The mpatch_decode function in mpatch.c in Mercurial before 4.6.1 mishandles certain situations where there should be...

CVE-2018-13348 is fixed in 2 products on 1 platform, first by mercurial 4.5.3-1ubuntu2.1, released July 5, 2018. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2018-13348
- Priority: Routine
- CVSS: n/a (Medium)
- EPSS: 0.0215
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jul 5, 2018

## Description

The mpatch_decode function in mpatch.c in Mercurial before 4.6.1 mishandles certain situations where there should be at least 12 bytes remaining after the current position in the patch data, but actually are not, aka OVE-20180430-0001.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | mercurial Ubuntu 18.04.6 LTS (bionic) | 4.5.3-1ubuntu2.1 | [mercurial 4.5.3-1ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-mercurial-4.5.3-1ubuntu2.1.md) | Jul 5, 2018 |
| Linux | mercurial-common Ubuntu 18.04.6 LTS (bionic) | 4.5.3-1ubuntu2.1 | [mercurial-common 4.5.3-1ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-mercurial-common-4.5.3-1ubuntu2.1.md) | Jul 5, 2018 |

---

Data as of 2026-11-07T12:40:37Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo