CVE-2019-25612
Published: 22 March 2026
Summary
CVE-2019-25612 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Softonic (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 4.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2019-25612 is a local structured exception handling (SEH) buffer overflow vulnerability in Admin Express version 1.2.5.485. The flaw resides in the System Compare feature, where the left-hand side Folder Path field fails to properly handle oversized inputs, enabling attackers to supply an alphanumeric encoded payload that triggers the overflow.
Local attackers who can run the application on the target system can exploit this vulnerability by pasting a crafted buffer overflow payload into the Folder Path field and clicking the scale icon. This action executes arbitrary shellcode with the privileges of the Admin Express application, granting high-impact confidentiality, integrity, and availability compromises as indicated by its CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H). No special privileges are required beyond local access, though user interaction is needed to trigger the exploit.
References include a proof-of-concept exploit on Exploit-DB (ID 46805) and a Vulncheck advisory detailing the local SEH buffer overflow via the Folder Path field. Softonic pages provide download links for Admin Express, but no vendor patches or specific mitigation steps are outlined in the available information. The issue maps to CWE-787 (Out-of-bounds Write).
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-19965
Vulnerability details
Admin Express 1.2.5.485 contains a local structured exception handling buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying an alphanumeric encoded payload in the Folder Path field. Attackers can trigger the vulnerability through the System Compare…
more
feature by pasting a crafted buffer overflow payload into the left-hand side Folder Path field and clicking the scale icon to execute shellcode with application privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local SEH buffer overflow enables arbitrary shellcode execution in a client application via crafted GUI input, directly mapping to Exploitation for Client Execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation of user inputs to the Folder Path field to prevent oversized or malformed payloads from triggering the SEH buffer overflow.
Implements memory protections like DEP and ASLR to block arbitrary code execution even if the buffer overflow in the System Compare feature is triggered.
Mandates timely patching and remediation of the known SEH buffer overflow vulnerability in Admin Express version 1.2.5.485.