CVE-2019-25327
Published: 12 February 2026
Description
Prime95 version 29.8 build 6 contains a buffer overflow vulnerability in the user ID input field that allows remote attackers to execute arbitrary code. Attackers can craft a malicious payload and paste it into the PrimeNet user ID and proxy…
more
host fields to trigger a bind shell on port 3110.
Mitigating Controls (NIST 800-53 r5)AI
SI-10 requires validation of inputs to the PrimeNet user ID and proxy host fields, directly preventing buffer overflows from malicious payloads.
SI-16 enforces memory protections such as ASLR and DEP, mitigating arbitrary code execution from the buffer overflow vulnerability.
SI-2 mandates timely flaw remediation, including patching Prime95 version 29.8 build 6 to eliminate the specific buffer overflow vulnerability.
Security SummaryAI
Prime95 version 29.8 build 6 contains a buffer overflow vulnerability (CWE-122) in the user ID input field, enabling remote attackers to execute arbitrary code. The issue affects the PrimeNet user ID and proxy host fields within this specific build of the Prime95 software, which is used for distributed computing tasks related to Mersenne prime searches.
Remote attackers can exploit this vulnerability over the network with low complexity and no privileges or user interaction required, as indicated by its CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). By crafting a malicious payload and pasting it into the affected input fields, attackers can trigger a bind shell on TCP port 3110, achieving full remote code execution on the target system.
Advisories and related resources, including a proof-of-concept exploit at https://www.exploit-db.com/exploits/47802, the official Mersenne site at https://www.mersenne.org, and a VulnCheck advisory at https://www.vulncheck.com/advisories/prime-version-build-buffer-overflow-seh, provide further details on the issue.
A public exploit is available, indicating potential for real-world exploitation against unpatched instances of the vulnerable Prime95 build.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in network-connected Prime95 application enables remote unauthenticated arbitrary code execution (RCE) over the network with no user interaction, directly facilitating T1190: Exploit Public-Facing Application.