CVE-2019-25550: 
VeryPDF PDF Editor vulnerability analysis and mitigation

CVE-2019-25550 is a buffer overflow vulnerability in VeryPDF Encrypt PDF version 2.3 that allows local attackers to crash the application by supplying excessively long strings in password fields. Specifically, pasting a 1000-byte buffer into the User Password or Master Password field in the Settings dialog triggers an application crash when importing PDF files. The vulnerability was formally published on March 21, 2026, and is classified as CWE-787 (Out-of-bounds Write). It carries a CVSS v3.1 base score of 5.5 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (VulnCheck Advisory, Exploit-DB).

The root cause is a classic buffer overflow (CWE-787: Out-of-bounds Write) resulting from the absence of input length validation on the User Password and Master Password fields in the Settings dialog. When a string exceeding the allocated buffer size (demonstrated with 1000 bytes of 'A' characters) is pasted into these fields and a PDF import is triggered, the application writes beyond the bounds of the allocated buffer, causing a crash. The attack vector is local, requiring the attacker to have interactive access to the application. A public proof-of-concept Python script is available on Exploit-DB that generates a 1000-byte payload file to reproduce the crash (Exploit-DB, VulnCheck Advisory).

Successful exploitation results in a denial-of-service condition, crashing the Encrypt PDF 2.3 application. There is no evidence of confidentiality or integrity impact — the vulnerability is limited to availability (application crash). Because the attack requires local access and only affects a single desktop application, the blast radius is confined to the affected workstation and does not facilitate lateral movement or data exfiltration (VulnCheck Advisory, Exploit-DB).

A proof-of-concept exploit is publicly available on Exploit-DB (EDB-46871), consisting of a Python script that generates a 1000-byte malicious input file to trigger the crash. There is no evidence of in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Exploit-DB, VulnCheck Advisory).

1. Prepare payload: Run the public Python PoC script to generate a malicious text file containing 1000 bytes of 'A' characters (buffer = "\x41" * 1000; f = open("EncryptPDF.txt", "w"); f.write(buffer); f.close()).
2. Open application: Launch VeryPDF Encrypt PDF 2.3 on the target system.
3. Navigate to Settings: Open the Settings dialog within the application.
4. Paste payload: Copy the 1000-byte buffer and paste it into the User Password or Master Password field.
5. Trigger crash: Initiate a PDF import operation; the application will attempt to process the oversized input, triggering an out-of-bounds write and crashing the application (Exploit-DB).

• File System: Presence of a file named EncryptPDF.txt containing a large string of repeated characters (e.g., 1000 'A' bytes) in user-accessible directories.
• Process: Unexpected termination (crash) of the EncryptPDF.exe process without user-initiated close action.
• Logs: Windows Event Log entries (Application log) recording an application error or fault for the Encrypt PDF process, potentially with an access violation exception code (e.g., 0xC0000005).

No official patch from VeryPDF has been confirmed as of the publication date. Recommended mitigations include: upgrading to a version of Encrypt PDF newer than 2.3 if and when one becomes available; restricting local user access to systems running Encrypt PDF 2.3; and implementing OS-level controls (e.g., application whitelisting, least-privilege accounts) to limit exposure. Administrators should also monitor for unexpected application crashes as a potential indicator of exploitation attempts (VulnCheck Advisory).