Cyber Resilience

CVE-2019-25328

MediumPublic PoC

Published: 12 February 2026

Published
12 February 2026
Modified
15 April 2026
KEV Added
Patch
CVSS Score v4 6.7 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0004 12.9th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2019-25328 is a medium-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Xnview (inferred from references). Its CVSS base score is 6.7 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 12.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-11 (Error Handling).

Deeper analysis

CVE-2019-25328 is a denial of service vulnerability in XnConvert version 1.82, specifically within its registration code input field. The flaw allows attackers to crash the application by pasting a 9000-byte buffer consisting of repeated characters into the field. It stems from a stack-based buffer overflow, as classified under CWE-121, and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

The vulnerability can be exploited by remote attackers requiring no privileges or user interaction. By supplying the crafted input to the registration code field, attackers achieve a denial of service condition, resulting in an application crash.

Advisories and related resources include a proof-of-concept exploit at https://www.exploit-db.com/exploits/47801 and a VulnCheck advisory at https://www.vulncheck.com/advisories/xnconvert-denial-of-service. The vendor's site at https://www.xnview.com and applications page at https://www.xnview.com/en/apps/ provide further context on XnConvert.

EU & UK References

Vulnerability details

XnConvert 1.82 contains a denial of service vulnerability in its registration code input field that allows attackers to crash the application. Attackers can generate a 9000-byte buffer of repeated characters and paste it into the registration code field to trigger…

more

an application crash.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?

Stack buffer overflow in desktop app registration field directly enables application-layer DoS via crafted input (T1499.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2020-37198Shared CWE-121
CVE-2025-1758Shared CWE-121
CVE-2026-36837Shared CWE-121
CVE-2019-25340Shared CWE-121
CVE-2025-50659Shared CWE-121
CVE-2020-37122Shared CWE-121
CVE-2020-37136Shared CWE-121
CVE-2019-25341Shared CWE-121
CVE-2025-70252Shared CWE-121
CVE-2020-37177Shared CWE-121

Affected Assets

Xnview
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Implements input validation at the registration code field to reject oversized 9000-byte buffers that trigger the stack-based buffer overflow crash.

prevent

Requires error handling that ignores invalid oversized inputs to the registration code field without compromising application availability via crash.

prevent

Mandates flaw remediation by applying patches or updates to address the specific stack buffer overflow in XnConvert 1.82.

References