CVE-2019-25695
Local Buffer Overflow in R 3.4.4 GUI Enables Code Execution
Publication date: 2026-04-12
Last updated on: 2026-04-12
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| r_project | r | 3.4.4 |
| r_project | r | to 3.4.4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2019-25695 is a local buffer overflow vulnerability in R version 3.4.4 that occurs in the GUI Preferences language field. An attacker can inject a specially crafted payload with a 292-byte offset and a JMP ESP instruction into the "Language for menus and messages" field. When this payload is pasted and confirmed, it triggers a buffer overflow that allows the attacker to execute arbitrary code on the affected system.
The exploit involves overflowing a buffer by inputting 292 bytes of data, overwriting the return address with a JMP ESP instruction found in user32.dll, and then executing shellcode such as launching calc.exe as a proof of concept.
How can this vulnerability impact me? :
This vulnerability allows an attacker with local access to execute arbitrary code on the affected system without requiring privileges or user interaction. This means an attacker can run malicious commands or programs, potentially compromising the confidentiality, integrity, and availability of the system.
Because the exploit can execute code such as launching applications or potentially more harmful payloads, it can lead to unauthorized control over the system, data theft, data corruption, or denial of service.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability is a local buffer overflow in R version 3.4.4 affecting the GUI Preferences language field. Detection involves verifying if the vulnerable R version is installed and checking if the malicious payload has been used in the 'Language for menus and messages' field.
Since the exploit requires local interaction with the R GUI, network detection is limited. On the system, you can check the installed R version by running the following command in R or a command prompt:
- In R console: `R.version.string`
- In Windows command prompt (if R is in PATH): `R --version`
Additionally, monitoring for suspicious clipboard activity or unexpected execution of programs like calc.exe after interacting with R's GUI Preferences could indicate exploitation attempts.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately avoid using R version 3.4.4 on Windows XP SP3 or earlier versions that are vulnerable.
Do not paste untrusted or suspicious input into the 'Language for menus and messages' field in the GUI Preferences of R.
If possible, upgrade to a newer, patched version of R that does not contain this vulnerability.
Restrict local access to systems running vulnerable R versions to trusted users only.
Monitor for unusual behavior such as unexpected execution of applications (e.g., calc.exe) triggered by R.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not include any details about the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.