CVE-2018-25299
Local Buffer Overflow in Prime95 via SEH Exploitation
Publication date: 2026-04-29
Last updated on: 2026-04-29
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mersenne_research | prime95 | to 29.4b8 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-120 | The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2018-25299 is a local buffer overflow vulnerability found in Prime95 version 29.4b8. It occurs due to improper handling of the optional proxy hostname field in the PrimeNet connection settings. Attackers can exploit this vulnerability by injecting malicious payloads into this field, which triggers a buffer overflow through the structured exception handling (SEH) mechanism. This overflow allows attackers to execute arbitrary code on the affected system.
How can this vulnerability impact me? :
This vulnerability can have serious impacts as it allows attackers to execute arbitrary code on the affected system without requiring user interaction or privileges. Successful exploitation could lead to unauthorized system command execution, potentially compromising system integrity, confidentiality, and availability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not include any details about how the Prime95 local buffer overflow vulnerability (CVE-2018-25299) affects compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
Prime95 version 29.4b8 contains a local buffer overflow vulnerability that allows attackers to execute arbitrary code by exploiting structured exception handling (SEH) mechanisms.
The vulnerability is triggered by injecting a malicious payload through the optional proxy hostname field in the PrimeNet connection settings, which causes the buffer overflow and enables execution of system commands.
How can this vulnerability impact me? :
This vulnerability poses a significant risk as it allows attackers to execute arbitrary code on the affected system without user interaction or privileges.
Successful exploitation can lead to unauthorized system command execution, potentially compromising system integrity, confidentiality, and availability.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves a local buffer overflow triggered by injecting a malicious payload through the optional proxy hostname field in the PrimeNet connection settings of Prime95 version 29.4b8 or earlier.
Detection on your system would involve checking the version of Prime95 installed and monitoring the proxy hostname field in PrimeNet connection settings for suspicious or unexpected input.
Since this is a local vulnerability, network detection commands are limited. However, you can check the installed Prime95 version using commands like:
- On Windows Command Prompt: `prime95.exe -version` or check the file properties of the executable.
- On Linux/macOS terminal: `prime95 -v` or `strings $(which prime95) | grep -i version`.
Additionally, monitoring logs or system behavior for crashes or unexpected execution related to Prime95 could indicate exploitation attempts.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, the immediate step is to upgrade Prime95 to a version later than 29.4b8 where this buffer overflow vulnerability is fixed.
If upgrading is not immediately possible, avoid using or configuring the optional proxy hostname field in PrimeNet connection settings to prevent injection of malicious payloads.
Additionally, restrict local access to systems running vulnerable versions of Prime95 to trusted users only, as the vulnerability requires local access.