Security readout for executives and security teams
Plain-English summary
Base64 Decoder 1.1.2 can be crashed and potentially forced to run attacker-controlled code through a malicious local input file. This is serious where the utility is installed and used, but the sources do not show remote exposure or confirmed exploitation in the wild.
Executive priority
Treat as a high-priority endpoint hygiene issue, not an internet-wide emergency. Prioritize removal or upgrade on systems where the utility is present, especially shared workstations or analyst machines handling external files.
Technical view
CVE-2019-25634 is a CWE-787 stack-based buffer overflow in 4Mhz Base64 Decoder 1.1.2. The bundle describes local arbitrary code execution via SEH overwrite from crafted input. Public exploit material exists, but KEV is false and no source confirms active exploitation.
Likely exposure
Exposure is likely limited to endpoints or lab systems with 4Mhz Base64 Decoder 1.1.2 installed. It is not described as a network service issue. Risk rises if users process untrusted files with this utility.
Exploitation context
The provided sources cite public exploit material, so proof-of-concept knowledge exists. They do not support a claim of active exploitation. Attackers need local opportunity to supply or trigger processing of a malicious input file.
Researcher notes
The bundle identifies version 1.1.2 and public exploit references, but does not name a vendor patch, fixed version, or in-the-wild exploitation. Validation should focus on installed software evidence and local abuse indicators rather than remote scanning.
Mitigation direction
- Inventory systems for 4Mhz Base64 Decoder 1.1.2.
- Remove the utility where it is not business-critical.
- Check vendor or advisory guidance for any fixed release.
- Prevent use of the tool on untrusted files.
- Run affected endpoints with least-privilege user accounts.
- Monitor for unusual crashes or executions involving the decoder.
Validation and detection
- Confirm installed product name and version on endpoints.
- Check software inventory for Base64 Decoder 1.1.2.
- Review endpoint telemetry for decoder crashes or suspicious child processes.
- Verify file-handling workflows do not process untrusted inputs.
- Confirm compensating controls cover local execution attempts.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-787: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2019-25634 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.6 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——VulnCheckCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H2.55.9VulnCheckVulnerability scoring details
Base CVSS 4.0 score
8.6HighVector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Base CVSS 3.1 score
8.4HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- ExploitDB-46625CVE reference, VulnCheck · exploit
- VulnCheck Advisory: Base64 Decoder 1.1.2 Local Buffer Overflow SEH EgghunterCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Write
Out-of-bounds Write represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.