CVE-2019-25741: Mobatek Mobaxterm

Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days.

Mobatek MobaXterm 12.1 contains a structured exception handling (SEH) based buffer overflow vulnerability in the username field of session files that allows remote attackers to execute arbitrary code. Attackers can craft a malicious MobaXterm sessions file with overflow data that triggers the vulnerability when imported and executed, enabling reverse shell execution with user privileges.

Affected products

• Mobatek Mobatek Mobaxterm: version 12.1 only

Published 2026-06-04. Last modified 2026-07-22.