CVE-2019-25659
Local Buffer Overflow in ASPRunner Professional Causes DoS
Publication date: 2026-04-05
Last updated on: 2026-04-05
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| asprunner | professional | 6.0.766 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
ASPRunner Professional 6.0.766 has a local buffer overflow vulnerability. This occurs when an attacker inputs a project name that is excessively long—specifically, 180 or more characters—during project creation. This causes the application to crash.
How can this vulnerability impact me? :
The vulnerability can cause a denial of service (DoS) by crashing the application when an attacker supplies a very long project name. This disrupts normal operation and availability of the software.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by attempting to reproduce the issue on the ASPRunner Professional 6.0.766 application. Specifically, by supplying a project name with 180 or more characters during project creation, you can check if the application crashes, indicating the presence of the buffer overflow.
There are no specific network detection commands or signatures provided for this vulnerability.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include avoiding the use of excessively long project names (180 or more characters) during project creation in ASPRunner Professional 6.0.766 to prevent triggering the buffer overflow and application crash.
Since this is a local buffer overflow vulnerability, restricting access to the application to trusted users and environments can reduce the risk of exploitation.
Applying any available patches or updates from the vendor once released is recommended to fully address the vulnerability.