CVE-2018-25258

CVE-2018-25258 is a local buffer overflow vulnerability affecting RGui version 3.5.0 in the GUI preferences dialog. The vulnerability exists in the "Language for menus and messages" input field and allows attackers to bypass DEP (Data Execution Prevention) protections through structured exception handling exploitation and ROP chain gadgets. An attacker can craft malicious input to trigger a stack-based buffer overflow that ultimately enables arbitrary code execution on the affected system. The vulnerability carries a CVSS score of 8.4 (HIGH), with a local attack vector requiring no special privileges or user interaction. The attack complexity is low, meaning it can be executed reliably. The impact is severe, affecting confidentiality, integrity, and availability of the compromised system. There is no evidence of active exploitation in the wild, as the vulnerability is not listed on the Known Exploited Vulnerabilities (KEV) catalog and does not appear on any active hot lists. The extremely low EPSS score of 0.00006 further indicates minimal community exploitation activity. No widely available public exploit code has been documented for this vulnerability.