CVE-2019-25627

HIGH

8.4

Beschreibung

FlexHEX 2.71 contains a local buffer overflow vulnerability in the Stream Name field that allows local attackers to execute arbitrary code by triggering a structured exception handler (SEH) overflow. Attackers can craft a malicious text file with carefully aligned shellcode and SEH chain pointers, paste the contents into the Stream Name dialog, and execute arbitrary commands like calc.exe when the exception handler is triggered.

CVE Details

CVSS v3.1 Bewertung8.4

SchweregradHIGH

CVSS VektorCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AngriffsvektorLOCAL

KomplexitatLOW

Erforderliche PrivilegienNONE

BenutzerinteraktionNONE

Veroffentlicht3/24/2026

Zuletzt geandert3/24/2026

Quellenvd

Honeypot-Sichtungen0

Schwachen (CWE)

CWE-434

Referenzen

http://www.flexhex.com(disclosure@vulncheck.com)

http://www.flexhex.com/download/flexhex_setup.exe(disclosure@vulncheck.com)

https://www.exploit-db.com/exploits/46665(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/flexhex-local-buffer-overflow-via-seh-unicode(disclosure@vulncheck.com)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.