CVE-2019-25695 - Vulnerability Analysis

Overview

R 3.4.4 contains a buffer overflow caused by injecting malicious input into the GUI Preferences language field, letting local attackers execute arbitrary code, exploit requires crafted payload with specific offset.

Severity & Score

Impact

Local attackers can execute arbitrary code, potentially taking full control of the system.

Mitigation

Update to the latest version of R.

References

• https://cloud.r-project.org/bin/windows/
• https://www.exploit-db.com/exploits/46265
• https://www.vulncheck.com/advisories/r-local-buffer-overflow-windows-xp-sp3

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner