CVE-2019-25633
Published: 24 March 2026
Summary
CVE-2019-25633 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Aida64 Aida64. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 16.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2019-25633 is a structured exception handling buffer overflow vulnerability in AIDA64 Extreme version 5.99.4900. The flaw resides in the email preferences and report wizard interfaces, where insufficient bounds checking on user-supplied input leads to a buffer overflow condition, classified under CWE-787 (Out-of-bounds Write). It carries a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Local attackers can exploit this vulnerability without requiring privileges or user interaction by injecting crafted payloads into the Display name field or Load from file parameter. Successful exploitation triggers the SEH overflow, enabling arbitrary code execution in the context of the application with its privileges.
References include an Exploit-DB entry (46636) demonstrating the issue, a Vulncheck advisory detailing the SEH buffer overflow via egghunter technique, the official AIDA64 website, and a download link for the vulnerable AIDA64 Extreme 5.99.4900 executable. Security practitioners should review these for exploit details and verify patching by upgrading to later versions.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-20006
Vulnerability details
AIDA64 Extreme 5.99.4900 contains a structured exception handling buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying malicious input through the email preferences and report wizard interfaces. Attackers can inject crafted payloads into the Display name…
more
field and Load from file parameter to trigger the overflow and execute shellcode with application privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local SEH buffer overflow enables arbitrary code execution in a client application (AIDA64), directly mapping to exploitation for client execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Flaw remediation directly mitigates this CVE by applying vendor patches to fix the buffer overflow vulnerability in AIDA64 Extreme.
Memory protection safeguards such as DEP and ASLR prevent arbitrary code execution from SEH buffer overflows triggered by crafted inputs.
Information input validation enforces bounds checking on user-supplied inputs like Display name and Load from file parameters to mitigate the out-of-bounds write.