CVE-2019-25572: 
NixOS vulnerability analysis and mitigation

CVE-2019-25572 is a denial of service (DoS) vulnerability in NordVPN 6.19.6 for Windows that allows local attackers to crash the application by submitting an excessively long string in the email input field during login. Specifically, pasting a buffer of approximately 100,000 characters into the email field triggers an application crash. The affected product scope is NordVPN for Windows up to and including version 6.19.6. It carries a CVSS v3.1 base score of 5.5 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (Feedly, VulnCheck Advisory).

The root cause is classified under CWE-1260 (Improper Handling of Overlap Between Protected Memory Ranges), with an estimated secondary classification of CWE-125 (Out-of-bounds Read). The vulnerability arises from insufficient input length validation in the email field of the NordVPN Windows login interface, allowing an oversized input buffer to corrupt memory and crash the application. Exploitation requires local access to the machine and the ability to interact with the NordVPN login UI. A proof-of-concept exploit was published on Exploit-DB (EDB-46343) demonstrating the crash via a 100,000-character paste into the email field (Exploit-DB, VulnCheck Advisory).

Successful exploitation results in a crash of the NordVPN application, causing a loss of VPN connectivity for the affected user (availability impact). There is no known confidentiality or integrity impact — the vulnerability does not expose data or allow unauthorized modification of system state. The scope is limited to the local NordVPN client process; no lateral movement or privilege escalation has been demonstrated (Feedly, VulnCheck Advisory).

A proof-of-concept exploit is publicly available on Exploit-DB (EDB-46343), though it has been assessed as not a real weaponized exploit — it demonstrates a simple UI-based crash rather than code execution. The EPSS score is extremely low at 0.000120, indicating minimal probability of active exploitation in the wild. There is no evidence of in-the-wild exploitation, no known threat actor attribution, and this CVE does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog (Exploit-DB, Feedly).

1. Local Access: Obtain local access to a Windows system running NordVPN version 6.19.6 or earlier.
2. Open Login UI: Launch the NordVPN application and navigate to the login screen where an email input field is presented.
3. Prepare Oversized Input: Generate or copy a string of approximately 100,000 characters (e.g., using a script: python -c "print('A' * 100000)").
4. Paste into Email Field: Paste the oversized string into the email input field of the NordVPN login form.
5. Trigger Crash: Submit or interact with the field to trigger the application crash, terminating the NordVPN process and dropping VPN connectivity (Exploit-DB, VulnCheck Advisory).

• Process: Unexpected termination of the NordVPN process (NordVPN.exe) without user-initiated shutdown.
• Logs: Windows Event Log entries (Application log) showing an application crash or fault for NordVPN.exe around the time of the incident.
• Network: Sudden drop in VPN tunnel traffic coinciding with the NordVPN process crash, potentially observable via network monitoring tools.

Users should upgrade NordVPN for Windows to a version beyond 6.19.6, as the vulnerability is fixed in later releases available via the official NordVPN download page. As a workaround, restricting local user access to the NordVPN application or deploying endpoint controls that limit clipboard paste operations in sensitive applications can reduce exposure. Organizations should monitor for unexpected NordVPN process crashes as a detection measure (VulnCheck Advisory, NordVPN).

Coverage of CVE-2019-25572 has been limited to vulnerability aggregator sites and automated CVE feeds, with no notable vendor statements, researcher commentary, or significant media coverage identified. The vulnerability was assigned by VulnCheck and published in March 2026 despite the original discovery dating to 2019 (Feedly).