CVE-2018-25299

Prime95 29.4b8 Local Buffer Overflow via SEH

Published Apr 29, 2026 CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Description

Prime95 29.4b8 contains a local buffer overflow vulnerability that allows attackers to execute arbitrary code by exploiting structured exception handling (SEH) mechanisms. Attackers can inject malicious payload through the optional proxy hostname field in the PrimeNet connection settings to trigger the overflow and execute system commands.

Analysis

Technical impact

Prime95 29.4b8 holds a local buffer overflow vulnerability that enables attackers to execute arbitrary code by taking advantage of the structured exception handling (SEH) mechanism. The overflow can be triggered by supplying a malicious proxy hostname string in the PrimeNet connection settings. Successful exploitation permits the attacker to run any system command with the privileges of the user running Prime95, effectively compromising the host.

Affected Systems

The vulnerability affects the Prime95 calculation engine distributed by Mersenne, specifically the 29.4b8 release and subsequent releases 30.7 and 30.7 build9 as listed in the CPE. Users operating these versions on any supported operating system harbor the flaw until the vendor issues a patch.

Risk and Exploitability

The CVSS score of 8.6 indicates a high severity for local arbitrary code execution. Because the vulnerability is local, an attacker must have the ability to run Prime95 or influence its configuration; no remote exploitation vector is documented. EPSS data is unavailable, but the flaw is listed as not in the KEV catalog, suggesting limited known exploitation. Nonetheless, the high CVSS and the ability to run arbitrary code with user privileges warrants immediate attention.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Mersenne

Prime95

affected

Version	Status	Constraints
`29.4b8`	affected	—

No data.

Vendor Product Versions

Mersenne

Prime95

Version	Status	Scheme	Platform
`29.4b8`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to the latest Prime95 release (e.g., 30.7 or later) which includes the SEH overflow fix.
Delete or rename any older Prime95 binaries from the system to prevent accidental use of the vulnerable version.
Disable the proxy hostname field or set it to a benign value such as localhost until the patch is applied.

Generated by OpenCVE AI on April 30, 2026 at 03:53 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.162% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact total

References

Link	Providers
https://www.exploit-db.com/exploits/44649
https://www.mersenne.org/
https://www.mersenne.org/download/#download
https://www.vulncheck.com/advisories/prime95-29-4b8-local-buffer-overflow-via-seh

History

Apr 30, 2026 2:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Apr 29, 2026 8:00 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Prime95 29.4b8 contains a local buffer overflow vulnerability that allows attackers to execute arbitrary code by exploiting structured exception handling (SEH) mechanisms. Attackers can inject malicious payload through the optional proxy hostname field in the PrimeNet connection settings to trigger the overflow and execute system commands.
Title		Prime95 29.4b8 Local Buffer Overflow via SEH
First Time appeared		Mersenne Mersenne prime95
Weaknesses		CWE-120
CPEs		cpe:2.3:a:mersenne:prime95:29.4b8:::::::* cpe:2.3:a:mersenne:prime95:30.7:-:::::: cpe:2.3:a:mersenne:prime95:30.7:build9::::::
Vendors & Products		Mersenne Mersenne prime95
References		https://www.exploit-db.com/exploits/44649 https://www.mersenne.org/ https://www.mersenne.org/download/#download https://www.vulncheck.com/advisories/prime95-29-4b8-local-buffer-overflow-via-seh
Metrics		cvssV3_1 `{'score': 8.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}` cvssV4_0 `{'score': 8.6, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`