Vulnerability Description
RGui 3.5.0 contains a local buffer overflow vulnerability in the GUI preferences dialog that allows attackers to bypass DEP protections through structured exception handling exploitation. Attackers can craft malicious input in the Language for menus and messages field to trigger a stack-based buffer overflow, execute a ROP chain for VirtualAlloc allocation, and achieve arbitrary code execution.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://cran.r-project.org/bin/windows/base/old/3.5.0/R-3.5.0-win.exe
- https://www.exploit-db.com/exploits/46107
- https://www.r-project.org/
- https://www.vulncheck.com/advisories/rgui-local-buffer-overflow-seh-dep-bypass
FAQ
What is CVE-2018-25258?
CVE-2018-25258 is a vulnerability with a CVSS score of 8.4 (HIGH). RGui 3.5.0 contains a local buffer overflow vulnerability in the GUI preferences dialog that allows attackers to bypass DEP protections through structured exception handling exploitation. Attackers ca...
How severe is CVE-2018-25258?
CVE-2018-25258 has been rated HIGH with a CVSS base score of 8.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-25258?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.