CVE-2019-25327
Published: 12 February 2026
Summary
CVE-2019-25327 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 36.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
Prime95 version 29.8 build 6 contains a buffer overflow vulnerability (CWE-122) in the user ID input field, enabling remote attackers to execute arbitrary code. The issue affects the PrimeNet user ID and proxy host fields within this specific build of the Prime95 software, which is used for distributed computing tasks related to Mersenne prime searches.
Remote attackers can exploit this vulnerability over the network with low complexity and no privileges or user interaction required, as indicated by its CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). By crafting a malicious payload and pasting it into the affected input fields, attackers can trigger a bind shell on TCP port 3110, achieving full remote code execution on the target system.
Advisories and related resources, including a proof-of-concept exploit at https://www.exploit-db.com/exploits/47802, the official Mersenne site at https://www.mersenne.org, and a VulnCheck advisory at https://www.vulncheck.com/advisories/prime-version-build-buffer-overflow-seh, provide further details on the issue.
A public exploit is available, indicating potential for real-world exploitation against unpatched instances of the vulnerable Prime95 build.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-19449
Vulnerability details
Prime95 version 29.8 build 6 contains a buffer overflow vulnerability in the user ID input field that allows remote attackers to execute arbitrary code. Attackers can craft a malicious payload and paste it into the PrimeNet user ID and proxy…
more
host fields to trigger a bind shell on port 3110.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in network-connected Prime95 application enables remote unauthenticated arbitrary code execution (RCE) over the network with no user interaction, directly facilitating T1190: Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 requires validation of inputs to the PrimeNet user ID and proxy host fields, directly preventing buffer overflows from malicious payloads.
SI-16 enforces memory protections such as ASLR and DEP, mitigating arbitrary code execution from the buffer overflow vulnerability.
SI-2 mandates timely flaw remediation, including patching Prime95 version 29.8 build 6 to eliminate the specific buffer overflow vulnerability.