CVE-2019-25564

PCHelpWareV2 1.0.0.5 Denial of Service via Group Field

Published Mar 21, 2026 CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Description

PCHelpWareV2 1.0.0.5 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string in the Group field. Attackers can paste a buffer overflow payload into the Group property field and click Ok to trigger an application crash.

Analysis

Technical impact

PCHelpWareV2 version 1.0.0.5 contains a buffer overflow in the Group field. By entering an excessively long string in that field and clicking the OK button, a local attacker can cause the application to crash, interrupting normal use. The vulnerability does not mention code execution or data disclosure. The crash is confined to the local application process and does not propagate to other system components.

Affected Systems

The affected products are Uvnc PCHelpWareV2 1.0.0.5 and the Uvnc UltraVNC component with the same build number. No other releases are identified as vulnerable.

Risk and Exploitability

The CVSS score of 6.8 indicates moderate severity. An EPSS score below 1% suggests a low probability of widespread exploitation, and the vulnerability is not included in the CISA KEV catalog. The description requires the attacker to manually supply a long string in the Group field and trigger the crash locally, so the attack vector is local. Remote exploitation is not feasible without direct local interaction. The relevant weakness is a classic buffer overflow (CWE-787).

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Uvnc

PCHelpWareV2

affected

Version	Status	Constraints
`1.0.0.5`	affected	—

Configuration 1 [-]

cpe:2.3:a:uvnc:pchelpwarev2:1.0.0.5:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Uvnc

Pchelpwarev2

Version	Status	Scheme	Platform
`1.0.0.5`	affected	generic	—

Uvnc

Ultravnc

Version	Status	Scheme	Platform
`1.0.0.5`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply any vendor‑supplied patch or newer version that addresses the Group field overflow.
If no patch is available, uninstall or disable the application on systems where it is not required.
Restrict local user privileges on machines running the application to prevent untrusted users from manipulating the Group field.
Configure monitoring or logging to detect repeated attempts to enter overly long values and alert when the application crashes.

Generated by OpenCVE AI on March 24, 2026 at 22:38 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.436% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
http://www.uvnc.eu/download/pchw2/PCHelpWareV2.msi
https://www.exploit-db.com/exploits/46709
https://www.uvnc.com/home.html
https://www.vulncheck.com/advisories/pchelpwarev2-denial-of-service-via-group-field

History

Mar 25, 2026 4:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mar 24, 2026 8:45 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:uvnc:pchelpwarev2:1.0.0.5:::::::*

Mar 23, 2026 10:00 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Uvnc pchelpwarev2
Vendors & Products		Uvnc pchelpwarev2

Mar 21, 2026 1:00 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		PCHelpWareV2 1.0.0.5 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string in the Group field. Attackers can paste a buffer overflow payload into the Group property field and click Ok to trigger an application crash.
Title		PCHelpWareV2 1.0.0.5 Denial of Service via Group Field
First Time appeared		Uvnc Uvnc ultravnc
Weaknesses		CWE-787
CPEs		cpe:2.3:a:uvnc:ultravnc:1.0.0.5:::::::*
Vendors & Products		Uvnc Uvnc ultravnc
References		http://www.uvnc.eu/download/pchw2/PCHelpWareV2.msi https://www.exploit-db.com/exploits/46709 https://www.uvnc.com/home.html https://www.vulncheck.com/advisories/pchelpwarev2-denial-of-service-via-group-field
Metrics		cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}` cvssV4_0 `{'score': 6.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`