CVE-2019-25340
Published: 12 February 2026
Summary
CVE-2019-25340 is a medium-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Nsasoft Spotauditor. Its CVSS base score is 6.7 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 11.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-11 (Error Handling).
Deeper analysis
SpotAuditor 5.3.2 contains a denial of service vulnerability in its Base64 decryption feature stemming from improper handling of an oversized buffer. This issue, tracked as CVE-2019-25340 and associated with CWE-121, enables attackers to crash the application. The vulnerability was published on 2026-02-12 with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Attackers require no privileges or user interaction and can exploit this remotely with low complexity. By generating a malformed input file consisting of 2000 repeated characters and pasting it into the Base64 Encrypted Password field, they trigger an application crash, disrupting availability for the affected user.
Advisories and related resources include the vendor site at http://www.nsauditor.com/, a proof-of-concept exploit at https://www.exploit-db.com/exploits/47719, and a detailed advisory from VulnCheck at https://www.vulncheck.com/advisories/spotauditor-base-denial-of-service. No specific patches or mitigations are detailed in the provided information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-19412
Vulnerability details
SpotAuditor 5.3.2 contains a denial of service vulnerability in its Base64 decryption feature that allows attackers to crash the application by supplying an oversized buffer. Attackers can generate a malformed input file with 2000 repeated characters to trigger an application…
more
crash when pasted into the Base64 Encrypted Password field.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in Base64 handling directly enables application crash via crafted input, matching Endpoint DoS through exploitation of software vulnerability.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents the DoS by validating Base64 inputs for proper size and format before decryption processing, rejecting oversized buffers.
Mitigates stack-based buffer overflow (CWE-121) through memory protections like address space randomization and stack guards, preventing application crashes.
Ensures graceful error handling for malformed or oversized inputs without compromising availability by crashing the application.