Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
Back to intelligence
endpoint-software-vulnerabilityproof-of-concept-release

Local Code Execution Flaws Disclosed in PDF Explorer and RGui

Updated 2mo agoFirst seen Mar 26, 20262 sources

Two newly cataloged CVEs detail local code execution vulnerabilities in Windows desktop applications PDF Explorer 1.5.66.2 and RGui 3.5.0. CVE-2018-25217 affects PDF Explorer through a structured exception handler (SEH) overflow in the application's Custom fields settings dialog, where malicious data placed in the Label field can overwrite SEH records and enable arbitrary code execution. The issue is mapped to CWE-787 and was published with CVSS v4.0 and v3.1 scoring, alongside references to Exploit-DB, RTT Software, a trial installer, and a VulnCheck advisory.

CVE-2018-25258 affects RGui 3.5.0 through a stack-based buffer overflow in the GUI preferences dialog, specifically the Language for menus and messages field. The disclosure says an attacker can use SEH-based exploitation to bypass DEP, run a ROP chain that calls VirtualAlloc, and achieve arbitrary code execution on the local system. The entry was published with CVSS v4.0 and v3.1 vectors and references to the affected R 3.5.0 Windows binary, Exploit-DB, the R Project website, and a VulnCheck advisory.

Share:
Local Code Execution Flaws Disclosed in PDF Explorer and RGui
Stay ahead

Get ahead of threats like this

Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.

Start free trial
EVENT TIMELINE

How this story unfolded

2 events from the most recent confirmed update back to the earliest known activity.

2 EVENTS
Apr 12, 20262mo ago

CVE-2018-25258 disclosed for RGui 3.5.0 buffer overflow

A CVE entry for RGui 3.5.0 documented a local buffer overflow in the GUI preferences dialog, triggered through the "Language for menus and messages" field. The disclosure said attackers could bypass DEP with SEH exploitation, use a ROP chain invoking VirtualAlloc, and achieve arbitrary code execution.

Mar 26, 20263mo ago

CVE-2018-25217 disclosed for PDF Explorer SEH overflow

A CVE entry for PDF Explorer 1.5.66.2 documented a local code execution vulnerability caused by a structured exception handler overflow in the Custom fields settings dialog's Label field. The disclosure described arbitrary code execution via SEH overwrite, buffer overflow techniques, and ROP gadget chains.

LINKED ENTITIES

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

3 LINKEDOpen in app
Vulnerabilities
1 linked
SEH-based local code execution in PDF Explorer 1.5.66.2
Organizations
2 linked
VulnCheckRTT Software
SOURCE COVERAGE

Sources

2 references tracked. Mallory keeps watching after this page renders.

2 SOURCESView all
The operational view lives in Mallory

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t — which of your assets are affected, which threat actors are using it right now, which detections to deploy, and what to do next.
Start free trial
Exposure mapping

Map indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidence

Every observed campaign, victim, and pivot linked to actors named in this story.

Associated malware

Malware, exploits, and IOCs connected to the activity described here.

Detection signatures

YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alerts

Get matching new stories delivered to your team as they break — not the next morning.

AI threads

Ask questions about this story and take action on the answers.