# CVE-2019-25666: Nsauditor SpotAuditor buffer overflow in Base64 Password Decoder

Source: https://junglewise.ai/threats/cve-2019-25666-nsauditor-spotauditor-buffer-overflow-in-base64-password-decoder  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-05. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2019-25666 · Severity: medium · CVSS 6.2 · Published 2026-04-05

SpotAuditor, a password recovery and auditing tool, contains a security flaw in its password decoding component. A local user can cause the application to crash by entering an excessively long string of text into the Base64 decoder tool. This results in a denial of service, preventing the software from functioning correctly until it is restarted.

Vendors: [Nsasoft](https://junglewise.ai/threats/vendors/nsasoft).

## Quick answers

**Is CVE-2019-25666 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2019-25666 being exploited in the wild.

**How severe is CVE-2019-25666?** Medium severity, with a CVSS score of 6.2, published 5 April 2026.

**Which products and versions are affected?** Nsauditor SpotAuditor 3.6.7 and earlier.

**Is there a fix for CVE-2019-25666?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2019-25666 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2019-25666?** Check whether you run Nsasoft Spotauditor. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A local buffer overflow vulnerability exists in SpotAuditor version 3.6.7 and potentially earlier versions within the 'Base64 Password Decoder' component. The flaw is rooted in an out-of-bounds write (CWE-787) triggered when the application processes an oversized Base64 string provided through the decoder interface. An attacker with local access to the system can exploit this by pasting a specially crafted long string into the 'Base64 Encrypted Password' field and clicking 'Decrypt'. Successful exploitation results in an immediate application crash (Denial of Service). While currently documented as a DoS, buffer overflows of this nature can sometimes be leveraged for arbitrary code execution depending on memory protections in place.

## Affected products

- Nsauditor SpotAuditor 3.6.7 and earlier

## Timeline

- 2019-01-30: disclosed: Vulnerability discovered by Rafael Pedrero
- 2019-02-04: other: Proof of concept exploit published on Exploit-DB
- 2026-04-05: advisory: CVE-2019-25666 published via VulnCheck/NVD

## References

- [http://www.nsauditor.com/order.html](http://www.nsauditor.com/order.html)
- [https://www.exploit-db.com/exploits/46313](https://www.exploit-db.com/exploits/46313)
- [https://www.vulncheck.com/advisories/spotauditor-denial-of-service-buffer-overflow](https://www.vulncheck.com/advisories/spotauditor-denial-of-service-buffer-overflow)

## Related threats

- [Nsasoft SpotAuditor stack-based buffer overflow in registration field](https://junglewise.ai/threats/cve-2019-25434-nsasoft-spotauditor-stack-based-buffer-overflow-in-registration)