Security readout for executives and security teams
Plain-English summary
UltraVNC Viewer 1.2.2.4 can be crashed by an oversized value in its VNC Server field. The known impact is denial of service to the viewer application, not data theft or system takeover. Business urgency is highest where this viewer supports remote administration or operational response workflows.
Executive priority
Treat as a focused high-priority availability issue, not a broad compromise event. Prioritize systems where remote access reliability affects operations, incident response, or support teams.
Technical view
CVE-2019-25600 is a CWE-787 out-of-bounds write/buffer overflow in UltraVNC Viewer 1.2.2.4. The CVSS 4.0 score is 7.1 with network attack vector, low complexity, no privileges, and required user interaction. Reported impact is high availability impact to the vulnerable viewer.
Likely exposure
Exposure is limited to environments running UltraVNC Viewer 1.2.2.4. Systems that do not use this specific viewer version are not shown as affected by the provided sources.
Exploitation context
A public Exploit-DB reference exists, but the source bundle does not show CISA KEV listing or confirmed active exploitation. Successful triggering requires user interaction with the vulnerable viewer input path.
Researcher notes
The record identifies only UltraVNC Viewer 1.2.2.4. The provided sources do not name a fixed version. Avoid expanding affected ranges without vendor confirmation. Public exploit material exists, but active exploitation is not evidenced here.
Mitigation direction
- Inventory endpoints for UltraVNC Viewer 1.2.2.4.
- Remove or upgrade affected viewer installations where possible.
- Check UltraVNC guidance for supported versions and any vendor-recommended fix.
- Restrict use of the affected viewer in critical operational workflows.
- Educate administrators not to use untrusted VNC connection strings.
Validation and detection
- Confirm UltraVNC Viewer version on managed endpoints.
- Verify whether version 1.2.2.4 is present in software inventory.
- Review helpdesk or endpoint logs for repeated viewer crashes.
- Confirm remediation by rechecking installed viewer versions.
- Track vendor advisories for any specific fixed release information.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-787: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2019-25600 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
7.1HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- ExploitDB-46702CVE reference · exploit
- Official Product HomepageCVE reference · product
- Product ReferenceCVE reference · product
- VulnCheck Advisory: UltraVNC Viewer 1.2.2.4 Denial of Service via Buffer OverflowCVE reference · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Write
Out-of-bounds Write represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.