CVE-2018-25293: Prime95 Buffer Overflow DoS Vulnerability

CVE-2018-25293 Overview

CVE-2018-25293 is a buffer overflow vulnerability affecting Prime95 version 29.4b7. The vulnerability exists in the PrimeNet connection dialog and allows local attackers to crash the application by supplying an excessively long string in the optional proxy password field. Attackers can trigger a denial of service by entering a 6000-byte payload into the proxy password parameter, causing the application to crash when processing the connection settings.

Critical Impact
Local attackers can cause a denial of service condition by exploiting the buffer overflow in the proxy password field, resulting in application crashes and service disruption for users running Prime95 distributed computing workloads.

Affected Products

Prime95 version 29.4b7 (Windows 32-bit)

Discovery Timeline

2026-04-26 - CVE CVE-2018-25293 published to NVD
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2018-25293

Vulnerability Analysis

This vulnerability is classified under CWE-120 (Buffer Copy without Checking Size of Input), commonly known as a classic buffer overflow. The flaw resides in the PrimeNet connection dialog component of Prime95, which is used to configure network settings for connecting to the GIMPS (Great Internet Mersenne Prime Search) distributed computing project.

The proxy password input field in the connection settings dialog lacks proper bounds checking when processing user-supplied input. When a user or attacker enters an oversized string (approximately 6000 bytes) into this field, the application attempts to copy the entire input into a fixed-size buffer without validating the input length. This causes a buffer overflow condition that corrupts adjacent memory regions, ultimately leading to an application crash.

The local attack vector means an attacker must have access to the system running Prime95 to exploit this vulnerability. While the impact is limited to denial of service (application crash), this can disrupt long-running prime number computations that may have been processing for extended periods.

Root Cause

The root cause is improper input validation in the proxy password handling code within the PrimeNet connection dialog. The application uses a fixed-size buffer to store the proxy password but fails to enforce a maximum length restriction on user input before copying data into this buffer. This classic buffer overflow pattern allows input exceeding the buffer's allocated size to overwrite adjacent memory.

Attack Vector

The attack requires local access to a system running Prime95 version 29.4b7. An attacker can exploit this vulnerability by:

Opening the PrimeNet connection dialog within the Prime95 application
Navigating to the proxy settings configuration
Entering an excessively long string (approximately 6000 bytes) into the proxy password field
Triggering the connection settings processing, which causes the buffer overflow and subsequent application crash

The attack is straightforward and requires no special privileges beyond the ability to interact with the Prime95 application interface. Due to the local attack vector, exploitation is limited to scenarios where an attacker already has access to the target system.

Detection Methods for CVE-2018-25293

Indicators of Compromise

Prime95 application crashes with memory corruption errors when proxy settings are accessed or modified
Unexpected application termination logs corresponding to Prime95 (prime95.exe on Windows)
System event logs showing buffer overflow or access violation exceptions from the Prime95 process

Detection Strategies

Monitor for Prime95 application crashes, particularly when they occur during network configuration changes
Implement endpoint detection rules to identify buffer overflow exploitation attempts targeting desktop applications
Use SentinelOne's behavioral AI to detect anomalous application crashes that may indicate exploitation attempts

Monitoring Recommendations

Enable application crash monitoring for systems running Prime95 distributed computing software
Review system event logs for patterns of repeated Prime95 crashes that may indicate exploitation attempts
Monitor for unusual input patterns to GUI applications that may suggest fuzzing or exploitation activity

How to Mitigate CVE-2018-25293

Immediate Actions Required

Upgrade Prime95 to a version newer than 29.4b7 where the buffer overflow has been addressed
If upgrade is not immediately possible, avoid configuring proxy settings through the PrimeNet dialog
Restrict physical and remote access to systems running vulnerable versions of Prime95

Patch Information

Users should download the latest version of Prime95 from the Mersenne Organization Homepage to ensure they have security fixes applied. The vulnerable version 29.4b7 should be replaced with the most current stable release available from the official GIMPS/Mersenne project.

For additional technical details, refer to the VulnCheck Prime95 DoS Advisory and Exploit-DB #45226.

Workarounds

Configure proxy settings through alternative methods such as system-wide proxy configuration rather than the Prime95 dialog
Run Prime95 in a sandboxed environment to limit the impact of potential crashes
Disable the PrimeNet functionality if distributed computing features are not required, running Prime95 in local/manual mode only