CVE-2019-25485: R-Project R

Medium severity, CVSS 6.2. EPSS: 0.1% chance of exploitation in the next 30 days.

R 3.4.4 on Windows x64 contains a buffer overflow vulnerability in the GUI Preferences language menu field that allows local attackers to bypass DEP and ASLR protections. Attackers can inject a crafted payload through the Language for menus preference to trigger a structured exception handler chain pivot and execute arbitrary shellcode with application privileges.

Affected products

Published 2026-03-11. Last modified 2026-06-17.