Executive brief
A security vulnerability exists in the R programming language environment, specifically within its graphical user interface. An attacker can execute unauthorized commands on a user's computer by tricking them into pasting a specially crafted text string into the 'Language' settings field. This could lead to a full system compromise, allowing the attacker to view sensitive data or disrupt operations.
Technical details
A local buffer overflow (CWE-787) exists in R version 3.4.4 within the GUI Preferences component. The vulnerability is triggered when a long, malicious string is pasted into the 'Language for menus and messages' field. An attacker can achieve arbitrary code execution by providing a payload with a 292-byte offset and a JMP ESP instruction to redirect execution to shellcode. While the exploit was originally demonstrated on Windows XP SP3, it represents a significant risk for local code execution wherever the vulnerable GUI component is used. Red Hat has noted the vulnerability but indicated that RHEL AI 3 is not affected.
Affected products
- r-project R 3.4.4
Timeline
- 2019-01-21: disclosed: Original exploit published on Exploit-DB
- 2026-04-12: advisory: CVE published and NVD entry created
References
- https://cloud.r-project.org/bin/windows/
- https://www.exploit-db.com/exploits/46265
- https://www.vulncheck.com/advisories/r-local-buffer-overflow-windows-xp-sp3
- https://access.redhat.com/security/cve/CVE-2019-25695
- https://bugzilla.redhat.com/show_bug.cgi?id=2457652
- https://security.access.redhat.com/data/csaf/v2/vex/2019/cve-2019-25695.json