Terminal Services Manager 3.1 Buffer Overflow SEH

Published 6 mo ago 2026-04-22 · modified 4 mo ago 2026-06-17 · JSON

CVSS

8.4

v3.1 · CNA

CISA KEV

not known exploited

EPSS

0.2%

percentile 9%

Public exploits

none known

Terminal Services Manager 3.1 contains a stack-based buffer overflow vulnerability in the computer names field that allows local attackers to execute arbitrary code by triggering structured exception handling. Attackers can craft a malicious input file with shellcode and jump instructions that overwrite the SEH handler pointer to execute calc.exe or other payloads when imported through the add computers wizard.

CISA SSVC assessment

Exploitation: Proof of concept public
Automatable: no
Technical impact: total
Assessed: 6 mo ago 2026-04-23

Exploit prediction (EPSS)

0.19% probability of exploitation in the next 30 days, higher than 9% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	4.0	8.6	`CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`
CNA	3.1	8.4	`CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
CNA	4.0	8.6	`CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
CNA	3.1	8.4	`CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
NVD	3.1	7.8	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`

Affected products

Lizardsystems Terminal Services Manager

Classification

Weakness

CWE-306 Missing Authentication for Critical Functionality

References

exploit-db.com /exploits/46058 · exploit
lizardsystems.com · product
vulncheck.com /advisories/terminal-services-manager-buffer-overflow-seh · third-party-advisory

Sources

CVE List: CVE-2018-25259
NVD: CVE-2018-25259

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary