Loading story…
Two high-severity vulnerabilities have been documented in the TiEmu calculator emulator, affecting TiEmu 3.03-nogdb+dfsg-3 and TiEmu 2.08 and earlier. The flaws, tracked as CVE-2016-20040 and CVE-2017-20225, are stack-based buffer overflows triggered through crafted command-line input. In the newer case, an oversized ROM parameter passed to the tiemu CLI can cause a stack overflow, potentially crashing the application or allowing arbitrary code execution.
The older issue similarly stems from insufficient bounds checking on user-controlled arguments and may permit arbitrary code execution in the context of the application. The published records classify the weakness as CWE-787 and note that exploitation could leverage techniques such as ROP to bypass protections and execute shellcode. Both CVE entries include severity scoring and references to external advisories and exploit material, indicating that locally supplied malicious input is sufficient to corrupt memory in affected TiEmu versions.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
A CVE record was received for a locally exploitable buffer overflow in TiEmu 3.03-nogdb+dfsg-3 triggered by an oversized ROM parameter passed to the tiemu command-line interface. The published details say the stack overflow could crash the application or potentially allow arbitrary code execution.
A CVE record was received for a stack-based buffer overflow affecting TiEmu 2.08 and earlier, caused by insufficient boundary checks on command-line input. The entry states the flaw could enable arbitrary code execution, including via ROP-assisted shellcode execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity vulnerabilities, `CVE-2018-25265` and `CVE-2018-25268`, were documented for **LanSpy 2.0.1.159**, affecting the application's scan functionality and exposing users to local buffer overflow attacks. The flaws were classified as `CWE-787` and can let an attacker trigger memory corruption by supplying oversized input in the scan section or scan field, causing application crashes and creating a path to arbitrary code execution. The published details indicate that `CVE-2018-25265` can be exploited through structured exception handling (SEH), including egghunter-based shellcode discovery and controlled jumps, while `CVE-2018-25268` allows instruction pointer overwrite with a payload consisting of 688 bytes of padding followed by 4 bytes of attacker-controlled data. Both entries were assigned high-impact CVSS v3.1 and CVSS v4.0 severity metrics, and the records reference material from **LizardSystems**, **Exploit-DB**, and **VulnCheck**.
Jun 29, 2026
Two high-severity vulnerabilities, **CVE-2026-5349** and **CVE-2026-5350**, were disclosed in the discontinued **Trendnet TEW-657BRM** router firmware `1.00.1`, exposing the device to remote stack-based buffer overflow attacks through `/setup.cgi`. The flaws affect the `add_apcdb` and `update_pcdb` functions respectively, where crafted input to the `mac_pc_dba` argument can trigger memory corruption. Both issues are classified under **CWE-119** and **CWE-121**, with reported impact spanning confidentiality, integrity, and availability. Public exploit information is available for both vulnerabilities, increasing the risk to any TEW-657BRM devices still deployed despite the product having reached end-of-life years ago. Trendnet said the router has been unsupported since 2011 and that it cannot confirm the vulnerabilities, but indicated it plans to publish a notice and notify registered customers. Organizations still operating the model face exposure without a supported vendor remediation path.
Jun 29, 2026
Two high-severity vulnerabilities, **CVE-2019-25629** and **CVE-2019-25631**, affect **AIDA64 5.99.4900** products and can lead to local arbitrary code execution through structured exception handler (**SEH**) buffer overflows. The flaws were reported for **AIDA64 Extreme** and **AIDA64 Business**, respectively, and both are classified as **CWE-787** with a **CVSS v3.1** score vector of `AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, indicating high impact across confidentiality, integrity, and availability. In **CVE-2019-25629**, an attacker can abuse the Hardware Monitoring logging feature in AIDA64 Extreme by supplying a malicious **CSV log file path**, triggering shellcode execution when the application processes that path. In **CVE-2019-25631**, AIDA64 Business is vulnerable through the **SMTP display name** field in preferences or the report wizard, where an attacker can overwrite SEH pointers and use **egg hunter shellcode** to gain code execution. Public references for both issues include vendor pages, **Exploit-DB** listings, and **VulnCheck** advisories.
Jun 29, 2026