TI-2019-15723 Aliases CVE-2019-25670 GHSA-8jhw-xxm8-8883

River Past Video Cleaner 7.6.3 Buffer Overflow via SEH

HIGH 72CWE-787Published 2026-04-05 · Updated 2026-04-06

Key facts

Attack vector: Local
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

River Past Video Cleaner 7.6.3 contains a structured exception handler buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying a malicious string in the Lame_enc.dll field. Attackers can craft a payload with 280 bytes of padding, a next structured exception handler override, and shellcode to trigger code execution when the application processes the input.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.0021 11th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA and NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
riverpast	River Past Video Cleaner	7.6.3	—	No fix listed	CNA

River Past Video Cleaner Vendorriverpast Affected 7.6.3 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:river_past_video_cleaner_project:river_past_video_cleaner::::::::	up to 7.6.3	Vulnerable	River Past Video Cleaner Project

cpe:2.3:a:river_past_video_cleaner_project:river_past_video_cleaner:*:*:*:*:*:*:*:* Versions up to 7.6.3 Vulnerable ·River Past Video Cleaner Project

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2019-25670
2026-10-03 Alias added: GHSA-8jhw-xxm8-8883

References

Exploit 1

ExploitDB-46346

Other 1

Product Reference

TI-2019-15703 River Past CamDo 3.7.6 Structured Exception Handler Buffer Overflow CVSS 4.0HIGH 8.6
TI-2019-15702 River Past Audio Converter 7.7.16 Local Buffer Overflow DoS CVSS 4.0MEDIUM 6.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences