8.4high
CVE-2018-25258
RGui 3.5.0 Local Buffer Overflow SEH DEP Bypass
Published 6 mo ago · modified 4 mo ago · JSON
CVSS
8.4
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.2%
percentile 8%
Public exploits
0
none known
Summary
RGui 3.5.0 contains a local buffer overflow vulnerability in the GUI preferences dialog that allows attackers to bypass DEP protections through structured exception handling exploitation. Attackers can craft malicious input in the Language for menus and messages field to trigger a stack-based buffer overflow, execute a ROP chain for VirtualAlloc allocation, and achieve arbitrary code execution.
CISA SSVC assessment
- Exploitation
- Proof of concept public
- Automatable
- no
- Technical impact
- total
- Assessed
- 6 mo ago
Exploit prediction (EPSS)
0.19% probability of exploitation in the next 30 days, higher than 8% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 4.0 | 8.6 | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| CNA | 3.1 | 8.4 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 4.0 | 8.6 | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| CNA | 3.1 | 8.4 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
- R-Project RGui
Classification
- Weakness
- CWE-434 Unrestricted Upload of File with Dangerous Type
References
- exploit-db.com /exploits/46107 · exploit
- r-project.org / · product
- cran.r-project.org /bin/windows/base/old/3.5.0/R-3.5.0-win.exe · product
- vulncheck.com /advisories/rgui-local-buffer-overflow-seh-dep-bypass · third-party-advisory
Sources
- CVE List: CVE-2018-25258
- NVD: CVE-2018-25258
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.