CVE-2019-25670

CVE-2019-25670 is a structured exception handler buffer overflow vulnerability affecting River Past Video Cleaner version 7.6.3 and earlier. The flaw exists in the Lame_enc.dll component and allows local attackers to achieve arbitrary code execution by supplying a malicious string as input to the application. The vulnerability requires 280 bytes of padding combined with a crafted next structured exception handler override and shellcode payload to trigger code execution. The vulnerability carries a CVSS 3.1 score of 8.4 (HIGH) with a local attack vector, low attack complexity, no privilege requirement, and no user interaction needed. Successful exploitation results in complete compromise of confidentiality, integrity, and availability on the affected system. The EPSS score of 0.00017 indicates minimal prevalence among publicly disclosed CVEs, and the vulnerability is not tracked in CISA's Known Exploited Vulnerabilities catalog. Exploitation appears minimal based on available indicators. The vulnerability is not actively being exploited in the wild, no public exploit code availability has been confirmed, and community attention remains low, as evidenced by the inactive status on relevant security tracking lists. Organizations using River Past Video Cleaner should consider updating to a patched version, though the risk level appears relatively low given the local-only attack vector requirement.