CVE-2019-25656

HIGH 8.4

R i386 3.5.0 Local Buffer Overflow SEH

CVSS Score

8.4

EPSS Score

0.0%

EPSS Percentile

2th

R i386 3.5.0 contains a local buffer overflow vulnerability in the GUI Preferences dialog that allows local attackers to trigger a structured exception handler (SEH) overwrite by supplying malicious input. Attackers can craft a payload string in the 'Language for menus and messages' field to overwrite SEH records and achieve code execution with calculator or arbitrary shellcode.

CWE	CWE-787
Vendor	r-project
Product	r i386
Published	Apr 5, 2026
Last Updated	Apr 6, 2026

Stay Ahead of the Next One

Get instant alerts for r-project r i386

Be the first to know when new high vulnerabilities affecting r-project r i386 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

R-Project / R i386

3.5.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

exploit-db.com: https://www.exploit-db.com/exploits/46288 r-project.org: https://www.r-project.org/ cran.r-project.org: https://cran.r-project.org/bin/windows/base/old/3.5.0/R-3.5.0-win.exe vulncheck.com: https://www.vulncheck.com/advisories/r-i386-local-buffer-overflow-seh

Credits

Dino Covotsos - Telspace Systems