CVE-2019-25327: Prime95 Buffer Overflow RCE Vulnerability

CVE-2019-25327 Overview

CVE-2019-25327 is a heap-based buffer overflow vulnerability (CWE-122) affecting Prime95 version 29.8 build 6, a popular distributed computing application used for testing CPU stability and searching for Mersenne prime numbers. The vulnerability exists in the user ID input field and allows remote attackers to execute arbitrary code by crafting a malicious payload and pasting it into the PrimeNet user ID and proxy host fields, potentially triggering a bind shell on port 3110.

Critical Impact

This buffer overflow vulnerability enables attackers to achieve arbitrary code execution on affected systems. When successfully exploited, attackers can establish a bind shell on port 3110, providing persistent remote access to the compromised machine.

Affected Products

• Prime95 version 29.8 build 6
• PrimeNet client components with vulnerable user ID input handling
• Windows installations running the affected Prime95 build

Discovery Timeline

• 2026-02-12 - CVE CVE-2019-25327 published to NVD
• 2026-02-12 - Last updated in NVD database

Technical Details for CVE-2019-25327

Vulnerability Analysis

This vulnerability is classified as a heap-based buffer overflow (CWE-122) that occurs when Prime95 processes user-supplied input in the PrimeNet user ID and proxy host configuration fields. The application fails to properly validate the length of input data before copying it into a fixed-size heap buffer, allowing attackers to write data beyond the allocated memory region.

The exploitation of this vulnerability requires local access and user interaction, as the attacker must either convince a user to paste a malicious payload or gain access to the application's input fields directly. When triggered, the buffer overflow can corrupt adjacent heap memory structures, potentially allowing the attacker to hijack program execution flow.

The attack results in a bind shell being opened on port 3110, which provides the attacker with persistent remote command execution capabilities on the target system. This represents a significant security risk for systems running the vulnerable Prime95 version, particularly in environments where multiple users have access to the application.

Root Cause

The root cause of this vulnerability lies in inadequate input validation and boundary checking within Prime95's handling of the PrimeNet user ID and proxy host input fields. The application allocates a fixed-size buffer on the heap for storing these configuration values but does not enforce proper length restrictions when accepting user input. When an oversized input string is provided, the application continues writing data past the buffer's allocated boundaries, corrupting adjacent heap memory.

This type of heap-based buffer overflow typically results from the use of unsafe string handling functions that do not perform bounds checking, such as strcpy() or sprintf(), instead of their safer alternatives like strncpy() or snprintf().

Attack Vector

The attack vector requires local access to the Prime95 application with user interaction. An attacker must craft a specially designed payload that, when pasted into either the PrimeNet user ID or proxy host input fields, triggers the buffer overflow condition. The payload is structured to overwrite critical heap metadata or function pointers, redirecting execution flow to attacker-controlled shellcode.

The exploitation process involves:

1. Crafting a malicious input string containing shellcode and overflow data
2. Pasting the payload into the vulnerable PrimeNet user ID or proxy host fields
3. Triggering the buffer overflow when the application processes the input
4. Hijacking execution flow to the embedded shellcode
5. Opening a bind shell on port 3110 for remote access

Technical details about the exploitation technique can be found in the Exploit-DB entry #47802 and the VulnCheck Advisory.

Detection Methods for CVE-2019-25327

Indicators of Compromise

• Unexpected network connections or listening services on port 3110
• Prime95 process (prime95.exe) exhibiting abnormal behavior or crashes
• Unusual child processes spawned by the Prime95 application
• Memory access violations or heap corruption errors in Prime95 logs

Detection Strategies

• Monitor for new listening services on port 3110, which is not a standard service port
• Deploy endpoint detection rules to identify suspicious process behavior from prime95.exe
• Implement application whitelisting to prevent unauthorized code execution from Prime95
• Use memory protection features such as DEP and ASLR to detect exploitation attempts

Monitoring Recommendations

• Enable detailed logging for network connections initiated by or directed to Prime95
• Monitor process creation events for any child processes spawned by Prime95
• Implement network segmentation to isolate systems running distributed computing applications
• Review firewall logs for unexpected outbound connections from systems running Prime95

How to Mitigate CVE-2019-25327

Immediate Actions Required

• Update Prime95 to the latest available version from the official Mersenne website
• Restrict network access to systems running Prime95, particularly blocking inbound connections on port 3110
• Implement application control policies to prevent untrusted input from being processed
• Audit systems running Prime95 version 29.8 build 6 for signs of compromise

Patch Information

Users should upgrade to a newer version of Prime95 that addresses this buffer overflow vulnerability. The latest version can be obtained from the official Mersenne website. Organizations should verify the integrity of downloaded software using checksums provided by the vendor before installation.

Additional technical details about this vulnerability are available in the VulnCheck Advisory on Buffer Overflow.

Workarounds

• Disable the PrimeNet functionality if network participation is not required
• Run Prime95 in an isolated environment or virtual machine with restricted network access
• Implement strict input validation at the application or network boundary level
• Block port 3110 on host-based and network firewalls to prevent bind shell connections

# Block port 3110 to prevent potential bind shell connections
# Windows Firewall example
netsh advfirewall firewall add rule name="Block CVE-2019-25327 Bind Shell" dir=in action=block protocol=tcp localport=3110
netsh advfirewall firewall add rule name="Block CVE-2019-25327 Bind Shell Out" dir=out action=block protocol=tcp localport=3110

# Linux iptables example
iptables -A INPUT -p tcp --dport 3110 -j DROP
iptables -A OUTPUT -p tcp --sport 3110 -j DROP