CVE-2018-25259

CVE-2018-25259 is a stack-based buffer overflow vulnerability affecting Terminal Services Manager version 3.1, located in the computer names input field. An attacker can exploit this flaw by crafting a malicious input file containing shellcode that overwrites the structured exception handling (SEH) pointer, allowing arbitrary code execution such as launching calc.exe or other payloads through the add computers wizard functionality. The vulnerability is classified as HIGH severity with a CVSS score of 8.4, as it requires only local access with no authentication or user interaction needed, presents low attack complexity, and provides complete compromise of confidentiality, integrity, and availability. The attack vector is local only, which limits its exposure but does not diminish the critical nature of potential impact on affected systems. This vulnerability is not currently being actively exploited in the wild, as evidenced by its absence from the CISA Known Exploited Vulnerabilities (KEV) catalog and inactive status on the Hot List. The EPSS probability score of 0.00012 indicates minimal likelihood of exploitation, and community attention remains limited. However, organizations running Terminal Services Manager 3.1 should implement appropriate access controls and consider upgrading to mitigate this locally exploitable threat.