CVE-2018-25299

Prime95 29.4b8 Local Buffer Overflow via SEH

High8.6EPSS 0.16%

Published: 29 Apr 2026
Updated: 30 Apr 2026
Reserved: 29 Apr 2026
Assigned by: VulnCheck

Description

Prime95 29.4b8 contains a local buffer overflow vulnerability that allows attackers to execute arbitrary code by exploiting structured exception handling (SEH) mechanisms. Attackers can inject malicious payload through the optional proxy hostname field in the PrimeNet connection settings to trigger the overflow and execute system commands.

Scores

CVSS scores of CVE-2018-25299, by who scored it
Scored by	CVSS	Score	Vector
VulnCheckCNA (assigner)	4.0	High8.6	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
VulnCheckCNA (assigner)	3.1	High8.4	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVDNVD · Awaiting Analysis	4.0	High8.6	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.16% · top 95% of all CVEs (4 Nov 2026)
CISA SSVC: Exploitation: poc · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.6.

Weakness

CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (opens in a new tab)All about CWE-120 and its CVEs

Affected products

Mersenne · Prime95
- affected 29.4b8

References (4)

ExploitDB-44649 (opens in a new tab)exploit
Official Product Homepage (opens in a new tab)product
Product Reference (opens in a new tab)product
VulnCheck Advisory: Prime95 29.4b8 Local Buffer Overflow via SEH (opens in a new tab)third-party-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2018-25299](https://trackcve.app/badge/CVE-2018-25299.svg)](https://trackcve.app/cve/CVE-2018-25299)

Record last updated 30 Apr 2026, 13:59 UTC.