CVE-2019-25341
Published: 12 February 2026
Summary
CVE-2019-25341 is a medium-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Apple (inferred from references). Its CVSS base score is 6.7 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 13.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2019-25341 is a denial-of-service vulnerability in iNetTools for iOS version 8.20, affecting the Whois feature. The issue arises from improper input handling, classified as CWE-121 (stack-based buffer overflow), where a specially crafted 98-character buffer pasted into the Domain Name field triggers an application crash. It received a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity due to its potential for availability impact.
Remote attackers require no privileges or authentication to exploit this vulnerability and, per CVSS metrics, no user interaction. By supplying the malicious input, they can reliably crash the iNetTools application, disrupting its functionality for the affected user.
Advisories detail the issue, including a VulnCheck advisory on the iNetTools Whois denial-of-service and a proof-of-concept exploit on Exploit-DB (ID 47716). The application page is available on the Apple App Store, but no specific patches or mitigations are mentioned in the CVE details.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-19581
Vulnerability details
iNetTools for iOS 8.20 contains a denial of service vulnerability in the Whois feature that allows attackers to crash the application by manipulating input. Attackers can paste a specially crafted 98-character buffer into the Domain Name field to trigger an…
more
application crash.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in Whois input field directly enables remote application crash (DoS) via exploitation of client software.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents the stack-based buffer overflow in the Whois Domain Name field by enforcing input validation to reject oversized pasted buffers.
Implements runtime memory protections like stack canaries to detect and prevent exploitation of the stack buffer overflow leading to application crash.
Protects against denial-of-service effects from malicious inputs causing application crashes by limiting impact and detecting such events.