CVE-2018-25258

HIGH SEVERITY

CVSS Score & Metrics

Base Score

8.4 / 10

Vector String

                                        CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H                                    

Vulnerability Description

RGui 3.5.0 contains a local buffer overflow vulnerability in the GUI preferences dialog that allows attackers to bypass DEP protections through structured exception handling exploitation. Attackers can craft malicious input in the Language for menus and messages field to trigger a stack-based buffer overflow, execute a ROP chain for VirtualAlloc allocation, and achieve arbitrary code execution.

Vulnerability Details

Published Date

April 12, 2026

Last Modified

April 15, 2026

CWE ID

CWE-434

Source

NVD

Vendor

R-Project

Product

RGui

External References

https://cran.r-project.org/bin/windows/base/old/3.5.0/R-3.5.0-win.exe
https://www.exploit-db.com/exploits/46107
https://www.r-project.org/
https://www.vulncheck.com/advisories/rgui-local-buffer-overflow-seh-dep-bypass

CVE-2018-25258

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment