Read the docs
TI-2025-24318 Aliases CVE-2025-34164GHSA-xjv2-3c45-5x63

NetSupport Manager < 14.12.0000 Heap-Based Buffer Overflow

Priority MEDIUM 41CWE-122Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-122 and the CVSS impact.

Summary

A heap-based buffer overflow vulnerability in NetSupport Manager 14.x versions prior to 14.12.0000 allows a remote, unauthenticated attacker to cause a denial of service (DoS) or execute arbitrary code.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00659 51st percentileScored 2026-11-07
Fix Fixed NetSupport Manager (NetSupport Ltd.): 14.12.0000

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NetSupport Ltd.NetSupport Manager14.0 to before 14.12.000014.12.0000Patch availableCNA
  • NetSupport Manager VendorNetSupport Ltd. Affected 14.0 to before 14.12.0000 Fixed in 14.12.0000 Patch available CNA

Remediation

  • Fix · CNA NetSupport Manager (NetSupport Ltd.) Fixed in 14.12.0000

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    NetSupport Manager 14.12.0000

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2025-24319 NetSupport Manager < 14.12.0000 Stack-Based Buffer OverflowPriority LOW 39
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-34164
  2. 2026-10-03 Alias added: GHSA-xjv2-3c45-5x63
  3. 2026-10-09 EPSS moved to the 50th–90th percentile

References

Other 1

  • TI-2011-00339 Stack-based buffer overflow in NetSupport Manager Agent for Linux 11.00, for Solaris… CVSS 2.0HIGH 7.5
  • TI-2007-05057 Buffer overflow in NetSupport Manager (NSM) Client 10.00 and 10.20, and NetSupport School… CVSS 2.0HIGH 10.0
  • TI-2007-04874 NetSupport Manager Client before 10.20.0004 allows remote attackers to bypass the (1)… CVSS 2.0HIGH 10.0
  • TI-2025-24319 NetSupport Manager < 14.12.0000 Stack-Based Buffer Overflow CVSS 4.0HIGH 8.8
  • TI-2004-02607 SQL injection vulnerability in problist.asp in NetSupport DNA HelpDesk 1.01 allows remote… CVSS 2.0HIGH 7.5
  • TI-2004-01736 Invision NetSupport School Pro uses a weak encryption algorithm to encrypt passwords… CVSS 2.0MEDIUM 4.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences