CVE-2019-25329
Published: 12 February 2026
Summary
CVE-2019-25329 is a medium-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Internet-Soft Ftp Navigator. Its CVSS base score is 6.7 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 14.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2019-25329 is a denial of service vulnerability in FTP Navigator version 8.03. The issue enables attackers to crash the application by overwriting the Structured Exception Handler (SEH) with malicious input provided via the custom command input field. A specific payload of 4108 'A' characters followed by 4 'B' characters and 40 'C' characters triggers the crash when pasted into this input. The vulnerability is associated with CWE-121 and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high availability impact with no confidentiality or integrity effects.
Remote attackers can exploit this vulnerability without privileges or user interaction, requiring only low attack complexity over the network. By delivering the crafted payload to the custom command input, they achieve a complete denial of service, causing the FTP Navigator application to crash and rendering it unavailable to the user.
Advisories and related resources include the vendor site at http://www.internet-soft.com/, an Exploit-DB entry with a proof-of-concept at https://www.exploit-db.com/exploits/47794, and a VulnCheck advisory at https://www.vulncheck.com/advisories/ftp-navigator-custom-command-denial-of-service-seh. No specific patches or mitigations are detailed in the CVE description.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-19569
Vulnerability details
FTP Navigator 8.03 contains a denial of service vulnerability that allows attackers to crash the application by overwriting Structured Exception Handler (SEH) with malicious input. Attackers can generate a payload of 4108 'A' characters followed by 4 'B' characters and…
more
40 'C' characters to trigger a program crash when pasted into the custom command input.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow with SEH overwrite enables remote application crash via crafted input, directly mapping to application exploitation for endpoint DoS.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Validates inputs to the custom command field to reject oversized or malformed payloads that trigger SEH overwrite and application crash.
Implements memory protections like stack canaries, ASLR, DEP, and safe SEH to block successful Structured Exception Handler overwrites from buffer overflows.
Restricts input sizes and types to the custom command field, preventing the 4108+ character payload from causing buffer overflow and denial of service.