Cyber Resilience

CVE-2019-25358

HighPublic PoC

Published: 18 February 2026

Published
18 February 2026
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v4 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0038 30.1th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2019-25358 is a high-severity Assumed-Immutable Data is Stored in Writable Memory (CWE-1282) vulnerability in Sourceforge (inferred from references). Its CVSS base score is 8.7 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 30.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2019-25358 is a denial of service vulnerability affecting FileOptimizer version 14.00.2524. The issue arises from improper handling of the TempDirectory parameter in the FileOptimizer32.ini configuration file, where attackers can overwrite it with a 5000-character buffer. This manipulation causes the application to crash when the options dialog is opened. The vulnerability is associated with CWE-1282 and has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Any unauthenticated attacker can exploit this vulnerability remotely with low complexity and no user interaction required. By crafting a malicious FileOptimizer32.ini file with an oversized TempDirectory value, the attacker triggers a crash upon the victim opening the options in the affected application, resulting in denial of service.

References include the SourceForge project pages for FileOptimizer, an Exploit-DB proof-of-concept (exploit 47586), and a Vulncheck advisory detailing the denial of service issue. These resources provide additional technical details, but no specific patch or mitigation steps are outlined in the available information. Security practitioners should review the advisories and avoid using the vulnerable version 14.00.2524.

EU & UK References

Vulnerability details

FileOptimizer 14.00.2524 contains a denial of service vulnerability that allows attackers to crash the application by manipulating the FileOptimizer32.ini configuration file. Attackers can overwrite the TempDirectory parameter with a 5000-character buffer to cause the application to crash when opening options.

CWE(s)
CWE-1282

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
attack.mitre.org →
Why these techniques?

Direct mapping to application exploitation causing crash/DoS via malicious config file buffer.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2018-25229Shared CWE-1282

Affected Assets

Sourceforge
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly addresses the vulnerability by requiring validation of configuration file inputs like the oversized TempDirectory parameter to prevent application crashes.

SC-5 Denial-of-service Protection good match
prevent

Provides specific protections against denial-of-service events such as the buffer-induced crash from manipulated FileOptimizer32.ini files.

SI-11 Error Handling partial match
prevent

Ensures graceful error handling for invalid configuration inputs, mitigating crashes without diagnostic output that could exacerbate the denial of service.

References