CVE-2019-25358
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2019-25358 is a high-severity Assumed-Immutable Data is Stored in Writable Memory (CWE-1282) vulnerability in Sourceforge (inferred from references). Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 31th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2019-25358 is a denial of service vulnerability affecting FileOptimizer version 14.00.2524. The issue arises from improper handling of the TempDirectory parameter in the FileOptimizer32.ini configuration file, where attackers can overwrite it with a 5000-character buffer. This manipulation causes the application to crash when the options dialog is opened. The vulnerability is associated with CWE-1282 and has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Any unauthenticated attacker can exploit this vulnerability remotely with low complexity and no user interaction required. By crafting a malicious FileOptimizer32.ini file with an oversized TempDirectory value, the attacker triggers a crash upon the victim opening the options in the affected application, resulting in denial of service.
References include the SourceForge project pages for FileOptimizer, an Exploit-DB proof-of-concept (exploit 47586), and a Vulncheck advisory detailing the denial of service issue. These resources provide additional technical details, but no specific patch or mitigation steps are outlined in the available information. Security practitioners should review the advisories and avoid using the vulnerable version 14.00.2524.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-19707
Vulnerability Data
FileOptimizer 14.00.2524 contains a denial of service vulnerability that allows attackers to crash the application by manipulating the FileOptimizer32.ini configuration file. Attackers can overwrite the TempDirectory parameter with a 5000-character buffer to cause the application to crash when opening options.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct mapping to application exploitation causing crash/DoS via malicious config file buffer.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the vulnerability by requiring validation of configuration file inputs like the oversized TempDirectory parameter to prevent application crashes.
Provides specific protections against denial-of-service events such as the buffer-induced crash from manipulated FileOptimizer32.ini files.
Ensures graceful error handling for invalid configuration inputs, mitigating crashes without diagnostic output that could exacerbate the denial of service.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Protecting integrity of data-at-rest directly addresses tampering with assumed-immutable values stored in writable memory.
Secure SDLC activities should identify and eliminate storage of immutable data in field-writable memory.
Pre-acquisition integrity checks can catch devices or firmware that place immutable data in writable memory.
Configuration-management practices can enforce use of read-only or write-once storage for immutable data.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure development life cycle mandates hardware-enforced immutability or protected storage for bootloaders and device identifiers.
Secure system architecture principles require hardware write-protection or one-time-programmable memory for immutable data.
Secure coding practices can avoid storing immutable data in writable memory but do not address hardware-level protection.
Change management can restrict field updates to immutable data but does not enforce the underlying storage design.
Configuration management enforces immutable firmware and write-once settings, directly preventing unauthorized reprogramming of assumed-immutable data.