Is CVE-2019-25741 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2019-25741 being exploited in the wild.

How severe is CVE-2019-25741?

Critical severity, with a CVSS score of 9.8, published 4 June 2026.

Is there a fix for CVE-2019-25741?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2019-25741 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2019-25741?

Check whether you run Mobatek MobaXterm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2019-25741: Mobatek MobaXterm buffer overflow in session file username field

CVE-2019-25741 · Severity: critical · CVSS 9.8 · Published 2026-06-04

Mobatek MobaXterm is a popular enhanced terminal for Windows used by IT professionals to manage remote servers and network equipment. A vulnerability in how the application handles session configuration files allows an attacker to take control of a user's computer. By tricking a user into importing and opening a specially crafted session file, an attacker can execute malicious code with the same permissions as the logged-in user, potentially leading to full system compromise or data theft.

Technologies: Mobatek MobaXterm. Vendors: Mobatek.

Quick answers

Is CVE-2019-25741 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2019-25741 being exploited in the wild.
How severe is CVE-2019-25741?: Critical severity, with a CVSS score of 9.8, published 4 June 2026.
Which products and versions are affected?: Mobatek MobaXterm <= 12.1.
Is there a fix for CVE-2019-25741?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2019-25741 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2019-25741?: Check whether you run Mobatek MobaXterm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A classic buffer overflow (CWE-120) exists in Mobatek MobaXterm versions up to and including 12.1. The vulnerability is located in the processing of the 'username' field within .mxtsessions configuration files. By providing an excessively long string in this field, an attacker can trigger a structured exception handling (SEH) overwrite. While the attack vector is categorized as network-based due to the delivery of the malicious file, it requires a user to import and execute the crafted session file. Successful exploitation allows for arbitrary code execution, such as a reverse shell, within the context of the application's process. Public exploit code demonstrates this bypasses standard protections on older Windows environments (e.g., XP) where SafeSEH may not be active.

Affected products

Mobatek MobaXterm <= 12.1

Timeline

2019-08-31: other: Vulnerability discovered by researcher
2019-09-27: other: Exploit published on Exploit-DB
2026-06-04: advisory: CVE published and added to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.