CVE-2019-25365

CriticalPublic PoC

Published: 18 February 2026

Published

18 February 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0026 49.6th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2019-25365 is a critical-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Chaospro (inferred from references). Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 49.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Client Execution (T1203). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

SI-10 mandates validation of configuration file path inputs to directly prevent buffer overflows from maliciously crafted payloads.

SI-16 Memory Protection good match

prevent

SI-16 enforces memory protections that mitigate SEH overwrite exploits triggered by the buffer overflow vulnerability.

SI-2 Flaw Remediation good match

prevent

SI-2 requires timely flaw remediation to patch the specific buffer overflow in ChaosPro's configuration file path handling.

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution

Adversaries may exploit software vulnerabilities in client applications to execute code.

attack.mitre.org →

Why these techniques?

The buffer overflow vulnerability in ChaosPro client software enables arbitrary code execution via SEH overwrite from a remote network vector without user interaction, directly facilitating T1203 Exploitation for Client Execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

ChaosPro 2.0 contains a buffer overflow vulnerability in the configuration file path handling that allows attackers to execute arbitrary code by overwriting the Structured Exception Handler. Attackers can craft a malicious configuration file with carefully constructed payload to overwrite memory…

and gain remote code execution on vulnerable Windows XP systems.

Deeper analysisAI

CVE-2019-25365 is a buffer overflow vulnerability (CWE-121) in the configuration file path handling of ChaosPro 2.0, a fractal visualization software. The flaw enables attackers to overwrite the Structured Exception Handler (SEH) through a specially crafted malicious configuration file, leading to arbitrary code execution. It affects vulnerable installations of ChaosPro 2.0 running on Windows XP systems.

Remote attackers require no privileges, authentication, or user interaction to exploit this vulnerability over the network, as indicated by its CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). By delivering a carefully constructed payload in the configuration file, attackers can overwrite memory and achieve remote code execution on the target system.

Advisories and related resources include the ChaosPro vendor website at http://www.chaospro.de/, a proof-of-concept exploit documented at https://www.exploit-db.com/exploits/47551, and a detailed advisory from VulnCheck at https://www.vulncheck.com/advisories/chaospro-buffer-overflow. No specific patches or mitigations are detailed in the available information.

A public proof-of-concept exploit exists, highlighting the risk for any remaining Windows XP deployments, an end-of-life operating system.