Skip to content
OpenAdvisories
Medium · 6.2 Public exploit CVE-2019-25485 EUVD-2019-19763GHSA-48cq-3q6q-vxm7

R 3.4.4 Windows x64 Buffer Overflow SEH DEP ASLR Bypass

Published Mar 11, 2026 · Updated Jul 15, 2026 · Assigned by VulnCheck

Vendor: R-Project Product: R

Description

R 3.4.4 on Windows x64 contains a buffer overflow vulnerability in the GUI Preferences language menu field that allows local attackers to bypass DEP and ASLR protections. Attackers can inject a crafted payload through the Language for menus preference to trigger a structured exception handler chain pivot and execute arbitrary shellcode with application privileges.

Affected products

VendorProductAffectedFixed
R-Project R 3.4.4 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • TheMalwareGuardian/CVE-2019-25485 ★ 0 · Mar 19, 2026

    Stack-based buffer overflow in R 3.4.4. Full exploitation on x86, but only RIP control with gadget analysis on x64 due to program constraints. The same vulnerability across two architectures, leading…

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References