CVE-2019-25569: Crun Realterm Buffer Overflow Vulnerability

CVE-2019-25569 Overview

CVE-2019-25569 is a stack-based buffer overflow vulnerability in RealTerm Serial Terminal version 2.0.0.70. The flaw resides in the application's Echo Port input field, where oversized input corrupts the Structured Exception Handler (SEH) chain. A local attacker can paste a crafted string consisting of 268 bytes of padding followed by SEH overwrite values into the Port field to crash the application. The vulnerability is categorized under [CWE-787] (Out-of-bounds Write) and impacts availability only. Exploitation requires local interaction with the running application and produces a denial-of-service condition in the terminal process.

Critical Impact
Local attackers can crash RealTerm 2.0.0.70 by submitting a 268-byte padded payload that overwrites the SEH chain through the Echo Port field.

Affected Products

Crun RealTerm Serial Terminal 2.0.0.70
RealTerm builds distributed through the RealTerm SourceForge project
Deployments using the vulnerable Echo Port input handler

Discovery Timeline

2026-03-21 - CVE-2019-25569 published to NVD
2026-03-24 - Last updated in NVD database

Technical Details for CVE-2019-25569

Vulnerability Analysis

RealTerm is a Windows serial and TCP terminal used to capture, debug, and inject data on communication ports. The vulnerable build, version 2.0.0.70, fails to validate the length of user input supplied to the Echo Port field. When an oversized string is pasted into the field, the application writes past the bounds of a fixed-size stack buffer. The write overflows into the saved SEH record stored on the stack frame.

Overwriting the SEH pointer corrupts the exception dispatch chain. When the application subsequently triggers an exception, control flow follows the attacker-controlled SEH value, terminating the process. The advisory describes the outcome as a crash rather than reliable code execution, and the impact metrics in the CVSS vector reflect availability loss only (VA:H) with no confidentiality or integrity impact.

Root Cause

The root cause is missing bounds checking on input handed to the Echo Port field. The field accepts a string longer than the fixed stack buffer reserved for it, and the copy routine writes the excess bytes into adjacent stack memory, including the SEH frame. This pattern matches [CWE-787] Out-of-bounds Write.

Attack Vector

Exploitation is local. The attacker must interact with the running RealTerm GUI on the target host. The published technique uses a payload of 268 bytes of padding followed by SEH overwrite values, pasted into the Port field. See Exploit-DB #46391 and the VulnCheck RealTerm Advisory for the documented payload structure. No remote attack vector or authentication is involved; the crash occurs in the user session running the terminal.

Detection Methods for CVE-2019-25569

Indicators of Compromise

Unexpected termination of realterm.exe shortly after user input is supplied to the Port or Echo Port field.
Windows Application Event Log entries reporting a faulting application realterm.exe with an access violation in the SEH dispatcher.
Presence of RealTerm version 2.0.0.70 on endpoints, identifiable by file version metadata on the realterm.exe binary.

Detection Strategies

Inventory endpoints for installations of RealTerm and flag any host running version 2.0.0.70 or earlier.
Monitor for repeated crashes of realterm.exe originating from the same user session, which can indicate exploitation attempts.
Correlate Windows Error Reporting (WER) telemetry on RealTerm processes with clipboard or paste activity preceding the crash.

Monitoring Recommendations

Forward Windows Application and WER event logs to a central log platform to identify recurring RealTerm faults.
Track process termination telemetry for realterm.exe and alert when exit codes indicate an unhandled exception.
Maintain software inventory data for serial terminal tooling on engineering and OT workstations to catch unmanaged installs.

How to Mitigate CVE-2019-25569

Immediate Actions Required

Identify all hosts running RealTerm 2.0.0.70 and restrict use until a patched build is deployed.
Limit installation of RealTerm to users who require it for serial debugging, and remove the binary from shared or kiosk systems.
Educate operators not to paste untrusted input into the Port or Echo Port fields.

Patch Information

No vendor patch is referenced in the published advisory data for CVE-2019-25569. Review the RealTerm Official Website and the RealTerm Source Files for newer builds, and validate any updated version against the SEH overflow before redeploying.

Workarounds

Replace RealTerm 2.0.0.70 with an alternative serial terminal where feasible until a fixed version is verified.
Run RealTerm under a standard user account so that a crash cannot affect privileged services on the host.
Apply application allowlisting to prevent unauthorized copies of the vulnerable build from being introduced to managed endpoints.

bash

# Configuration example: query installed RealTerm version on Windows endpoints
Get-CimInstance Win32_Product | Where-Object { $_.Name -like "*RealTerm*" } | Select-Object Name, Version, InstallLocation