Loading vulnerability…
SEH Buffer Overflow in AIDA64 Extreme 5.99.4900 Logging Functionality
CVE-2019-25629 is a local arbitrary code execution vulnerability in AIDA64 Extreme 5.99.4900. The flaw is described as a structured exception handler (SEH) buffer overflow in the application's logging functionality. An attacker can supply a malicious CSV log file path via the Hardware Monitoring logging preferences, and when AIDA64 processes that path, the overflow can be triggered. The vulnerability enables shellcode injection through the crafted log file path, resulting in execution of attacker-controlled code in the context of the application.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows arbitrary code execution on the local system in the security context of the user running AIDA64 Extreme. Given the assigned impact metrics, exploitation can result in high impact to confidentiality, integrity, and availability, including full compromise of data accessible to the user, modification of system or application state within that context, and potential application crash or broader system instability.
If you can’t patch tonight, do this now.
Until a confirmed fix is deployed, avoid using untrusted or externally supplied CSV log file paths in AIDA64 Hardware Monitoring logging preferences. Restrict local access to systems running the vulnerable version, prevent untrusted users from modifying AIDA64 configuration or preferences, and monitor for abnormal application behavior or crashes associated with logging configuration changes. Running the application with least privilege will reduce post-exploitation impact.
Patch, then assume compromise.
Upgrade from AIDA64 Extreme 5.99.4900 to a vendor-fixed version if one is available. If no patched release is currently confirmed in the provided material, users should obtain the latest version directly from the vendor and verify whether the issue has been addressed. Any functionality that accepts or stores the CSV log file path in Hardware Monitoring logging preferences should be reviewed and corrected to enforce proper bounds checking and safe handling of path input.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.