CVE-2019-25570: Crun Realterm DoS Vulnerability

CVE-2019-25570 Overview

CVE-2019-25570 is a denial of service vulnerability in RealTerm Serial Terminal 2.0.0.70, a Windows-based serial communications utility. A local attacker can crash the application by pasting an overly long string of approximately 1000 characters into the Port input field and clicking the open button. The flaw is categorized under [CWE-1260] (Improper Handling of Overlap Between Protected Memory Ranges) and impacts availability of the terminal process. No authentication is required, but user interaction is needed to trigger the crash. The issue affects the legacy serial console used by engineers and embedded developers for hardware debugging.

Critical Impact
Local attackers with the ability to interact with the RealTerm UI can trigger an application crash, disrupting active serial communications and ongoing hardware debugging sessions.

Affected Products

RealTerm Serial Terminal 2.0.0.70
Crun RealTerm distributions packaging the 2.0.0.70 build
Systems with cpe:2.3:a:crun:realterm:2.0.0.70 installed

Discovery Timeline

2026-03-21 - CVE-2019-25570 published to NVD
2026-03-24 - Last updated in NVD database

Technical Details for CVE-2019-25570

Vulnerability Analysis

The vulnerability resides in how RealTerm 2.0.0.70 handles user-supplied input in the Port field of its connection configuration dialog. When a string of roughly 1000 characters is pasted into this field and the open button is clicked, the application fails to handle the oversized input safely and terminates. The result is a denial of service against the local RealTerm process. The flaw requires local access and user interaction, which limits its remote exploitability. Active sessions, including captured serial logs and live device monitoring, are lost when the crash occurs.

Root Cause

The root cause is improper validation of the length of the Port field input before it is processed by the connection routine. RealTerm does not enforce a safe upper bound on the pasted string, allowing the oversized buffer to reach internal code paths that cannot accommodate it. This aligns with [CWE-1260], reflecting improper handling around protected memory boundaries during input processing.

Attack Vector

Exploitation requires local access to a system running RealTerm 2.0.0.70 and the ability to interact with its graphical interface. The attacker pastes a 1000-character payload into the Port field and clicks the open button. The application immediately crashes. Public proof-of-concept material is referenced in the Exploit-DB #46390 entry and the VulnCheck RealTerm DoS Advisory. No verified exploit code is reproduced here; refer to those sources for technical details.

// No verified exploitation code available.
// See Exploit-DB #46390 and the VulnCheck advisory for technical details.

Detection Methods for CVE-2019-25570

Indicators of Compromise

Unexpected termination of realterm.exe processes on engineering workstations
Windows Application event log entries showing crash faults attributed to RealTerm 2.0.0.70
Loss of active serial logging sessions without a clean shutdown by the operator

Detection Strategies

Monitor for repeated RealTerm crash events on the same host within short time windows
Alert on the presence of realterm.exe version 2.0.0.70 across managed endpoints
Correlate clipboard paste activity into RealTerm with subsequent process termination

Monitoring Recommendations

Inventory all installations of RealTerm using endpoint software inventory tooling
Track Windows Error Reporting (WER) entries referencing realterm.exe
Review user activity on shared engineering or lab workstations where RealTerm is installed

How to Mitigate CVE-2019-25570

Immediate Actions Required

Identify all systems running RealTerm 2.0.0.70 and restrict interactive access to trusted users
Remove RealTerm from systems where it is not actively required for serial communications
Train operators to avoid pasting untrusted content into the Port field

Patch Information

No vendor patch is listed in the available references. Refer to the RealTerm Project Homepage and RealTerm Files Download for the latest available builds. Evaluate any newer release against the behavior described in the VulnCheck RealTerm DoS Advisory before redeployment.

Workarounds

Replace RealTerm 2.0.0.70 with an alternative serial terminal for production engineering use
Restrict the application to standard user accounts only on shared lab workstations
Avoid pasting clipboard content of unknown origin into RealTerm input fields

bash

# Example: enumerate RealTerm installations on Windows endpoints via PowerShell
Get-WmiObject -Class Win32_Product |
  Where-Object { $_.Name -like "*RealTerm*" } |
  Select-Object Name, Version, InstallLocation