CVE-2019-25548 BlueStacks 4.80.0.1060 Denial of Service via Search Field

What is CVE-2019-25548?

CVE-2019-25548 is a medium-severity denial of service vulnerability in BlueStacks, published on 21 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

BlueStacks 4.80.0.1060 contains a denial of service vulnerability that allows local attackers to crash the application by submitting oversized input to the search field. Attackers can paste a buffer of 100,000 'A' characters into the search field and trigger a search operation to cause the application to crash.

Weakness: CWE-466

Which versions are affected by CVE-2019-25548?

It affects 1 product.

Products include Bluestacks Bluestacks.

How do I fix CVE-2019-25548?

No fix has been published for CVE-2019-25548 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2019-25548 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2019-25548 exists.

Other vulnerabilities in BlueStacks

• CVE-2018-0701 Auth bypass in BlueStacks App Player High 8.8
• CVE-2016-4288 Privilege escalation in App Player High 8.4
• CVE-2020-24367 Privilege escalation in n/a High 7.8
• CVE-2019-14220 Information disclosure in n/a Medium 6.5
• CVE-2025-44964 Weak cryptography in n/a Low 3.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-g2vx-5j3p-8xhf.