CVE-2018-25258
RGui 3.5.0 Local Buffer Overflow SEH DEP Bypass
- State
- Published
- Severity
- 8.6 High
- Published
- Apr 12, 2026
- Updated
- Apr 13, 2026
- Reserved
- Apr 12, 2026
Description
RGui 3.5.0 contains a local buffer overflow vulnerability in the GUI preferences dialog that allows attackers to bypass DEP protections through structured exception handling exploitation. Attackers can craft malicious input in the Language for menus and messages field to trigger a stack-based buffer overflow, execute a ROP chain for VirtualAlloc allocation, and achieve arbitrary code execution.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.6 High | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.4 High | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-434 Unrestricted Upload of File with Dangerous Type
Affected Products
| Product | Versions |
|---|---|
RGuiR-Project |
|
References
- ExploitDB-46107exploit
- Official Product Homepageproduct
- Product Referenceproduct
- VulnCheck Advisory: RGui 3.5.0 Local Buffer Overflow SEH DEP Bypassthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.