CVE-2018-25293: Prime95 Buffer Overflow DoS Vulnerability

CVE-2018-25293 Overview

CVE-2018-25293 is a buffer overflow vulnerability affecting Prime95 version 29.4b7. The vulnerability exists in the PrimeNet connection dialog and allows local attackers to crash the application by supplying an excessively long string in the optional proxy password field. Attackers can trigger a denial of service by entering a 6000-byte payload into the proxy password parameter, causing the application to crash when processing the connection settings.

Critical Impact

Local attackers can cause a denial of service condition by exploiting the buffer overflow in the proxy password field, resulting in application crashes and service disruption for users running Prime95 distributed computing workloads.

Affected Products

• Prime95 version 29.4b7 (Windows 32-bit)

Discovery Timeline

• 2026-04-26 - CVE CVE-2018-25293 published to NVD
• 2026-04-27 - Last updated in NVD database

Technical Details for CVE-2018-25293

Vulnerability Analysis

This vulnerability is classified under CWE-120 (Buffer Copy without Checking Size of Input), commonly known as a classic buffer overflow. The flaw resides in the PrimeNet connection dialog component of Prime95, which is used to configure network settings for connecting to the GIMPS (Great Internet Mersenne Prime Search) distributed computing project.

The proxy password input field in the connection settings dialog lacks proper bounds checking when processing user-supplied input. When a user or attacker enters an oversized string (approximately 6000 bytes) into this field, the application attempts to copy the entire input into a fixed-size buffer without validating the input length. This causes a buffer overflow condition that corrupts adjacent memory regions, ultimately leading to an application crash.

The local attack vector means an attacker must have access to the system running Prime95 to exploit this vulnerability. While the impact is limited to denial of service (application crash), this can disrupt long-running prime number computations that may have been processing for extended periods.

Root Cause

The root cause is improper input validation in the proxy password handling code within the PrimeNet connection dialog. The application uses a fixed-size buffer to store the proxy password but fails to enforce a maximum length restriction on user input before copying data into this buffer. This classic buffer overflow pattern allows input exceeding the buffer's allocated size to overwrite adjacent memory.

Attack Vector

The attack requires local access to a system running Prime95 version 29.4b7. An attacker can exploit this vulnerability by:

1. Opening the PrimeNet connection dialog within the Prime95 application
2. Navigating to the proxy settings configuration
3. Entering an excessively long string (approximately 6000 bytes) into the proxy password field
4. Triggering the connection settings processing, which causes the buffer overflow and subsequent application crash

The attack is straightforward and requires no special privileges beyond the ability to interact with the Prime95 application interface. Due to the local attack vector, exploitation is limited to scenarios where an attacker already has access to the target system.

Detection Methods for CVE-2018-25293

Indicators of Compromise

• Prime95 application crashes with memory corruption errors when proxy settings are accessed or modified
• Unexpected application termination logs corresponding to Prime95 (prime95.exe on Windows)
• System event logs showing buffer overflow or access violation exceptions from the Prime95 process

Detection Strategies

• Monitor for Prime95 application crashes, particularly when they occur during network configuration changes
• Implement endpoint detection rules to identify buffer overflow exploitation attempts targeting desktop applications
• Use SentinelOne's behavioral AI to detect anomalous application crashes that may indicate exploitation attempts

Monitoring Recommendations

• Enable application crash monitoring for systems running Prime95 distributed computing software
• Review system event logs for patterns of repeated Prime95 crashes that may indicate exploitation attempts
• Monitor for unusual input patterns to GUI applications that may suggest fuzzing or exploitation activity

How to Mitigate CVE-2018-25293

Immediate Actions Required

• Upgrade Prime95 to a version newer than 29.4b7 where the buffer overflow has been addressed
• If upgrade is not immediately possible, avoid configuring proxy settings through the PrimeNet dialog
• Restrict physical and remote access to systems running vulnerable versions of Prime95

Patch Information

Users should download the latest version of Prime95 from the Mersenne Organization Homepage to ensure they have security fixes applied. The vulnerable version 29.4b7 should be replaced with the most current stable release available from the official GIMPS/Mersenne project.

For additional technical details, refer to the VulnCheck Prime95 DoS Advisory and Exploit-DB #45226.

Workarounds

• Configure proxy settings through alternative methods such as system-wide proxy configuration rather than the Prime95 dialog
• Run Prime95 in a sandboxed environment to limit the impact of potential crashes
• Disable the PrimeNet functionality if distributed computing features are not required, running Prime95 in local/manual mode only