Prime95 29.4b7 has a buffer overflow in the PrimeNet connection dialog that lets a local user crash the program by entering an excessively long string in the optional proxy password field. The vulnerability results in a denial of service for the application; the crash occurs when the application processes the stored connection settings after the user supplies a payload, such as a 6000‑byte string. The weakness is a classic stack corruption (CWE‑120).

The issue affects the Mersenne Prime95 family, specifically version 29.4b7 and later build 30.7. Users running these versions that have the PrimeNet proxy feature enabled are susceptible to the crash.

The CVSS score of 6.9 indicates moderate severity, while the EPSS of less than 1% suggests that exploitation attempts are rare at present. The vulnerability is not listed in the CISA KEV catalog, meaning no known widespread exploitation has been observed. It requires local access to the machine running Prime95; remote exploitation would need the attacker to inject the payload via a user’s interaction with the proxy password field, which is not exposed over a network interface. Given the moderate score and low exploitation probability, the risk is significant mainly to users who depend on continuous Prime95 operations for computational work.