CVE-2019-25634 Base64 Decoder 1.1.2 Local Buffer Overflow SEH Egghunter
Local attackers can execute arbitrary code via a stack-based buffer overflow in Base64 Decoder by crafting a malicious input file.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-25634?
CVE-2019-25634 is a high-severity memory corruption vulnerability in 4Mhz Base64 Decoder, published on 24 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Base64 Decoder 1.1.2 contains a stack-based buffer overflow vulnerability that allows local attackers to execute arbitrary code by triggering a structured exception handler (SEH) overwrite. Attackers can craft a malicious input file that overflows a buffer, overwrites the SEH chain with a POP-POP-RET gadget address, and uses an egghunter payload to locate and execute shellcode for code execution.
Weakness: CWE-787
Which versions are affected by CVE-2019-25634?
It affects 1 product.
Products include 4mhz Base64 Decoder.
How do I fix CVE-2019-25634?
No fix has been published for CVE-2019-25634 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2019-25634 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2019-25634 exists.
Sources
Also known as GHSA-cpr2-5chx-jmj3.