CVE-2019-25656
Published: 05 April 2026
Summary
CVE-2019-25656 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in R Project (inferred from references). Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 5.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2019-25656 is a local buffer overflow vulnerability (CWE-787) in R i386 3.5.0, specifically within the GUI Preferences dialog. The flaw enables local attackers to trigger a structured exception handler (SEH) overwrite by supplying malicious input in the 'Language for menus and messages' field, potentially leading to code execution. This affects the Windows 32-bit version of R 3.5.0, as indicated by the vulnerable executable available at the provided CRAN archive link.
Local attackers with access to the affected system can exploit this vulnerability without privileges (PR:N), requiring low complexity (AC:L) and no user interaction (UI:N). By crafting a payload string, they can overwrite SEH records to achieve arbitrary code execution, demonstrated with payloads launching the calculator or executing shellcode. The CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects high confidentiality, integrity, and availability impacts in a local context.
References include a proof-of-concept exploit on Exploit-DB (ID 46288), a VulnCheck advisory detailing the R i386 local buffer overflow SEH issue, the official R Project website, and a direct download for the vulnerable R-3.5.0-win.exe. These resources confirm the vulnerability's details and public exploit availability but do not specify patches or vendor mitigations in the provided information. Security practitioners should ensure systems are updated beyond R 3.5.0.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-20048
Vulnerability details
R i386 3.5.0 contains a local buffer overflow vulnerability in the GUI Preferences dialog that allows local attackers to trigger a structured exception handler (SEH) overwrite by supplying malicious input. Attackers can craft a payload string in the 'Language for…
more
menus and messages' field to overwrite SEH records and achieve code execution with calculator or arbitrary shellcode.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local SEH buffer overflow in R GUI directly enables arbitrary code execution via exploitation of a client application vulnerability.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 mandates timely flaw remediation, directly addressing the buffer overflow vulnerability in R i386 3.5.0 by requiring patches or upgrades beyond version 3.5.0.
SI-16 provides memory protections like DEP and ASLR that prevent successful SEH overwrite and code execution from the local buffer overflow exploit.
SI-10 enforces validation of user inputs in fields like 'Language for menus and messages' to block malicious payloads causing the buffer overflow.