R 3.4.4 Local Buffer Overflow: Arbitrary Code Execution via GUI

A critical local buffer overflow vulnerability, identified as CVE-2019-25695, has been reported in R version 3.4.4. According to the National Vulnerability Database, this flaw allows attackers to achieve arbitrary code execution by injecting malicious input into the GUI Preferences language field. This isn’t some remote zero-day, but it’s a nasty local exploit that could give an attacker a beachhead if they gain initial access to a system.

The exploit reportedly involves crafting a payload with a 292-byte offset and a JMP ESP instruction. When this payload is pasted into the ‘Language for menus and messages’ field within the R GUI, it can trigger commands like calc.exe — a classic proof-of-concept for code execution. The National Vulnerability Database has assigned this vulnerability a CVSS score of 8.4 (HIGH), underscoring the severity of potential compromise.