Seh — CraftedSignal Threat Feed

Allok AVI to DVD SVCD VCD Converter Buffer Overflow Vulnerability

hello@craftedsignal.io — Wed, 29 Apr 2026 20:16:25 +0000

Allok AVI to DVD SVCD VCD Converter version 4.0.1217 is susceptible to a structured exception handling (SEH) based buffer overflow vulnerability. This vulnerability enables a local attacker to execute arbitrary code by crafting a specific payload. The attack involves providing a malicious string in the License Name field of the application. This can be exploited without requiring any prior authentication, making it a significant security concern for systems running the vulnerable software. The vulnerability was reported on April 29, 2026.

Attack Chain

The attacker prepares a malicious string payload consisting of junk data, an NSEH bypass, an SEH handler address, and shellcode.
The attacker opens the Allok AVI to DVD SVCD VCD Converter application.
The attacker navigates to the registration or license activation section of the software.
The attacker pastes the malicious string into the License Name field.
The attacker clicks the “Register” button, triggering the buffer overflow.
The overflow overwrites the SEH frame, redirecting execution flow to the attacker-controlled NSEH bypass.
The NSEH bypass redirects execution to the SEH handler address, which points to the attacker’s shellcode.
The shellcode executes, allowing the attacker to run arbitrary code on the system.

Impact

Successful exploitation of this buffer overflow vulnerability allows a local attacker to execute arbitrary code with the privileges of the user running the Allok AVI to DVD SVCD VCD Converter. This could lead to complete system compromise, data theft, or installation of malware. Given the ease of exploitation (no authentication required, local access only) this poses a significant risk to systems with the vulnerable software installed.

Recommendation

Deploy the Sigma rule Allok AVI Converter SEH Buffer Overflow to detect exploitation attempts based on process creation events.
Monitor for abnormal process execution originating from the Allok AVI to DVD SVCD VCD Converter application to identify potential exploitation (process_creation).
Consider removing the Allok AVI to DVD SVCD VCD Converter 4.0.1217 until a patch is available, due to the high severity and ease of exploitation.

RealTerm Serial Terminal SEH Buffer Overflow Vulnerability (CVE-2019-25679)

hello@craftedsignal.io — Sun, 05 Apr 2026 21:16:46 +0000

RealTerm Serial Terminal version 2.0.0.70 is vulnerable to a structured exception handling (SEH) buffer overflow in the Echo Port tab. This vulnerability, identified as CVE-2019-25679, allows a local attacker to execute arbitrary code on a vulnerable system. The attack requires the user to be running the RealTerm application. The attacker must craft a malicious payload containing shellcode and a POP POP RET gadget chain and paste it into the Port field within the Echo Port tab. Subsequently, the attacker needs to induce the user to click the “Change” button, triggering the buffer overflow and allowing arbitrary code execution within the context of the RealTerm application. This poses a significant risk, particularly in environments where RealTerm is used for debugging or serial communication.

Attack Chain

The attacker identifies a vulnerable RealTerm Serial Terminal 2.0.0.70 installation.
The attacker crafts a malicious payload containing shellcode and a POP POP RET gadget chain.
The attacker gains local access to the target system.
The attacker opens the RealTerm application and navigates to the Echo Port tab.
The attacker pastes the malicious payload into the Port field.
The attacker induces the user to click the “Change” button.
The buffer overflow occurs, overwriting the SEH handler.
The POP POP RET gadget chain is executed, redirecting control to the attacker’s shellcode, resulting in arbitrary code execution.

Impact

Successful exploitation of this vulnerability (CVE-2019-25679) allows a local attacker to execute arbitrary code on the affected system. This could lead to complete system compromise, including data theft, installation of malware, or denial of service. Although specific victim counts and targeted sectors are not available, the widespread use of RealTerm in technical environments makes this a potentially significant threat.

Recommendation

Deploy the “RealTerm SEH Overflow Attempt” Sigma rule to detect suspicious process creation following the execution of RealTerm with a long string supplied as an argument.
Monitor process creations where the parent process name is Realterm.exe using the “RealTerm Suspicious Child Process” Sigma rule.
Although not directly available, consider network monitoring to detect anomalies should the attacker install malware after successful exploitation.

AIDA64 Business SEH Buffer Overflow Vulnerability (CVE-2019-25631)

hello@craftedsignal.io — Tue, 24 Mar 2026 12:16:03 +0000

AIDA64 Business version 5.99.4900 is vulnerable to a structured exception handling (SEH) buffer overflow (CVE-2019-25631). A local attacker can exploit this vulnerability to execute arbitrary code with application privileges. The vulnerability stems from insufficient bounds checking when processing the SMTP display name field in the preferences or report wizard functionality. An attacker can inject malicious shellcode, specifically egg hunter shellcode, into this field to overwrite SEH…

Lavavo CD Ripper 4.20 SEH Buffer Overflow Vulnerability

hello@craftedsignal.io — Mon, 23 Mar 2026 14:00:00 +0000

Lavavo CD Ripper version 4.20 is susceptible to a critical structured exception handling (SEH) buffer overflow vulnerability. This vulnerability allows a local attacker to execute arbitrary code on a targeted system by crafting a malicious string and providing it as the License Activation Name. The vulnerability, identified as CVE-2019-25615, stems from insufficient bounds checking when handling the license activation data. Successful exploitation enables attackers to gain complete control over the affected system, potentially leading to data theft, system compromise, or further malicious activities within the local network. This poses a significant risk to users of Lavavo CD Ripper 4.20.

Attack Chain

Attacker prepares a malicious string crafted to exploit the SEH buffer overflow vulnerability in Lavavo CD Ripper 4.20. This string includes controlled buffer data, NSEH jump instructions, and SEH handler addresses.
The attacker launches Lavavo CD Ripper 4.20 on a vulnerable system.
The attacker navigates to the license activation section of the application.
The attacker enters the malicious string into the License Activation Name field.
The application processes the crafted input without proper bounds checking, resulting in a buffer overflow.
The overflow overwrites the SEH frame on the stack, replacing the standard SEH handler with the attacker-controlled SEH handler address.
An exception is triggered within the application, causing the program to jump to the attacker-controlled SEH handler.
The attacker’s code is executed, which sets up a bind shell on port 3110, allowing the attacker to remotely connect and control the system.

Impact

Successful exploitation of the SEH buffer overflow vulnerability in Lavavo CD Ripper 4.20 grants a local attacker the ability to execute arbitrary code with the privileges of the user running the application. This can lead to complete system compromise, including unauthorized access to sensitive data, installation of malware, and further lateral movement within the network. The bind shell on port 3110 provides a persistent backdoor for the attacker to maintain control over the compromised system.

Recommendation

Apply any available patches or updates for Lavavo CD Ripper to address CVE-2019-25615.
Implement application control mechanisms to prevent the execution of unauthorized or modified versions of Lavavo CD Ripper.
Deploy the Sigma rules below to detect potential exploitation attempts based on process creation (logsource: process_creation).
Monitor network connections for unexpected services listening on port 3110, which may indicate a successful bind shell (logsource: network_connection).