CVE-2019-25629: 
FinalWire AIDA64 vulnerability analysis and mitigation

CVE-2019-25629 is a structured exception handler (SEH) buffer overflow vulnerability in AIDA64 Extreme version 5.99.4900 that allows local attackers to execute arbitrary code. The flaw resides in the application's logging functionality, where a malicious CSV log file path can be injected via the Hardware Monitoring logging preferences to overflow the buffer and trigger code execution. It carries a CVSS v3.1 base score of 7.8 (High) and a CVSS v4.0 base score of 8.6 (High). The CVE was formally published on March 24, 2026, and is assigned by VulnCheck (VulnCheck Advisory, Exploit-DB).

The vulnerability is classified as CWE-787 (Out-of-bounds Write) and stems from insufficient bounds checking when AIDA64 Extreme processes the CSV log file path configured in its Hardware Monitoring logging preferences. An attacker with local access can craft a maliciously long or specially formatted file path containing shellcode, which overflows the structured exception handler (SEH) chain on the stack. When the application subsequently processes this path, the overwritten SEH record redirects execution to the attacker-controlled shellcode. No user interaction beyond configuring the log path is required for exploitation (VulnCheck Advisory, Exploit-DB).

Successful exploitation allows a low-privileged local attacker to execute arbitrary code with the permissions of the AIDA64 Extreme application process, resulting in high confidentiality, integrity, and availability impact on the affected system. An attacker could leverage this to read sensitive hardware monitoring data, modify application behavior, or use the compromised process as a foothold for further privilege escalation or lateral movement within the local environment (VulnCheck Advisory).

A proof-of-concept exploit is publicly listed on Exploit-DB (ID 46660), though automated analysis of the entry returned inconclusive results regarding its functional completeness. The EPSS score is approximately 0.013% (0.000130), indicating a very low probability of widespread exploitation in the near term. There is no evidence of in-the-wild exploitation, no threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Exploit-DB, VulnCheck Advisory).

1. Reconnaissance: Confirm the target system has AIDA64 Extreme version 5.99.4900 installed and that the attacker has local access with at least low-privileged credentials.
2. Access Hardware Monitoring settings: Open AIDA64 Extreme and navigate to the Hardware Monitoring logging preferences where the CSV log file path can be configured.
3. Craft malicious payload: Prepare a specially crafted file path string that exceeds the expected buffer length and embeds shellcode along with the necessary SEH overwrite offsets (nSEH and SEH handler address pointing to a POP POP RET gadget).
4. Inject the payload: Enter the malicious CSV log file path into the logging preferences field and save/apply the configuration.
5. Trigger code execution: Cause the application to process the configured log file path (e.g., by starting a logging session or restarting the application), which triggers the buffer overflow, overwrites the SEH chain, and redirects execution to the attacker's shellcode (Exploit-DB, VulnCheck Advisory).

• Process: Unexpected child processes spawned by the AIDA64 Extreme process (e.g., cmd.exe, powershell.exe, or network tools) following a logging configuration change.
• File System: Unusual or excessively long strings in AIDA64 configuration files or registry entries related to the CSV log file path setting.
• Logs: Application crash logs or Windows Event Log entries (Event ID 1000/1001) referencing AIDA64 Extreme around the time of exploitation attempts.
• Registry: Abnormal values in AIDA64 registry keys under HKCU\Software\FinalWire\AIDA64 related to logging preferences containing non-standard path strings.

Users should update AIDA64 Extreme to a version newer than 5.99.4900, as the vulnerability is specific to that release. As a workaround, restrict access to AIDA64 application settings to trusted administrators only, preventing low-privileged users from modifying Hardware Monitoring logging preferences. Additionally, monitor for suspicious or unusually long CSV log file path configurations within the application settings (VulnCheck Advisory, AIDA64).

Coverage of CVE-2019-25629 has been limited to automated CVE alert aggregators such as Red Packet Security and CVE feed services, with no notable researcher commentary or vendor statements identified. The vulnerability received minimal community attention, consistent with its local-only attack vector and low EPSS score (Red Packet Security).