CVE-2019-25691
Published: 12 April 2026
Summary
CVE-2019-25691 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Faleemi Desktop Software (inferred from references). Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 5.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2019-25691 is a local buffer overflow vulnerability (CWE-787) in Faleemi Desktop Software version 1.8. The issue occurs in the System Setup dialog, specifically the Save Path for Snapshot and Record file field, where insufficient bounds checking allows a crafted payload to overflow the buffer. This enables attackers to exploit structured exception handling (SEH) to bypass DEP protections and execute arbitrary code using ROP chain gadgets. The vulnerability carries a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Unprivileged local attackers can exploit this vulnerability by injecting a malicious string into the vulnerable field. With low attack complexity and no user interaction beyond local access, they can trigger the buffer overflow, hijack control flow via SEH, evade DEP, and chain ROP gadgets to achieve arbitrary code execution. Successful exploitation results in high confidentiality, integrity, and availability impacts, potentially allowing full system compromise from a local user context.
Advisories and references provide further details on exploitation. A proof-of-concept exploit is documented at https://www.exploit-db.com/exploits/46269, and the Vulncheck advisory at https://www.vulncheck.com/advisories/faleemi-desktop-software-local-buffer-overflow-seh-dep-bypass outlines the SEH DEP bypass technique. The vendor site is available at https://www.faleemi.com/. No specific patch or mitigation guidance is detailed in the provided information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-20126
Vulnerability details
Faleemi Desktop Software 1.8 contains a local buffer overflow vulnerability in the System Setup dialog that allows attackers to bypass DEP protections through structured exception handling exploitation. Attackers can inject a crafted payload into the Save Path for Snapshot and…
more
Record file field to trigger a buffer overflow and execute arbitrary code via ROP chain gadgets.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local buffer overflow in desktop software directly enables arbitrary code execution (via SEH/ROP/DEP bypass) from an unprivileged local context, mapping to exploitation for privilege escalation and full system compromise.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the insufficient bounds checking in the Save Path field by requiring validation of inputs to prevent buffer overflows from crafted payloads.
Implements memory protections like DEP, ASLR, and stack canaries to restrict unauthorized code execution from buffer overflow exploits, even with SEH and ROP attempts.
Mandates timely flaw remediation to patch the buffer overflow vulnerability in Faleemi Desktop Software, eliminating the root cause.