LiveActive security incident?Get immediate response
CVE Record

CVE-2019-25464: InputMapper 1.6.10 Local Denial of Service via Username Field

InputMapper 1.6.10 contains a buffer overflow vulnerability in the username field that allows local attackers to crash the application by entering an excessively long string. Attackers can trigger a denial of service by copying a large payload into the username field and double-clicking to process it, causing the application to crash.

MediumCVSS 6.7Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2019-25464 affects InputMapper 1.6.10. A local user can crash the application by entering an overly long username value. This is a denial-of-service issue, not a data theft or remote compromise issue based on the provided sources.

Executive priority

Treat as a moderate endpoint availability issue. Prioritize environments where shared or kiosk-like Windows systems rely on InputMapper. It is unlikely to drive enterprise-wide emergency response without evidence of broader impact or active exploitation.

Technical view

InputMapper 1.6.10 has a buffer-overflow condition in the username field. The CVSS 4.0 vector shows local attack vector, low complexity, no privileges required, and active user interaction required, with high impact to vulnerable application availability only.

Likely exposure

Exposure is limited to systems where InputMapper 1.6.10 is installed and accessible to a local user. The provided sources do not identify other affected versions or platforms.

Exploitation context

A public ExploitDB reference exists, but the source bundle does not support active exploitation in the wild. CISA KEV status is false. Abuse requires local access and user interaction with the application.

Researcher notes

The record cites CWE-770, though the description also states buffer overflow behavior. Evidence supports local application crash only. No confidentiality, integrity, system availability, patch, or fixed-version details are provided in the source bundle.

Mitigation direction

  • Inventory endpoints for InputMapper 1.6.10 installations.
  • Check vendor or trusted advisory sources for upgrade or removal guidance.
  • Restrict use of affected installations where untrusted local users have access.
  • Remove InputMapper 1.6.10 if it is not business-required.

Validation and detection

  • Confirm whether InputMapper 1.6.10 is installed on managed endpoints.
  • Review software inventory, endpoint management, or application allowlisting records.
  • Check whether local users can launch and interact with the application.
  • Track vendor or advisory updates for named remediation.
Prepared
Confidence
high
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-770: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2019-25464 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
6.7 (4.0)
Known Exploited
No
Published

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
6.7CVSS 4.0MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N——Primary CVE score

Vulnerability scoring details

Base CVSS 4.0 score

6.7Medium
CVSS 4.0 vector shape for CVE-2019-25464Attack VectorAttack ComplexityAttack RequirementsPrivileges RequiredUser InteractionVS ConfidentialityVS IntegrityVS AvailabilitySS ConfidentialitySS IntegritySS Availability

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Attack Requirements
NonePresent
Privileges Required
NoneLowHigh
User Interaction
NonePassiveActive
VS Confidentiality
HighLowNone
VS Integrity
HighLowNone
VS Availability
HighLowNone
SS Confidentiality
HighLowNone
SS Integrity
HighLowNone
SS Availability
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
DSD Consulting Services LLC.InputMapper1.6.10Listed
Weakness

CWE details

CWE-770

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.