Skip to main content

Pidgin CVE-2019-25544

| EUVDEUVD-2019-19837 MEDIUM
Reliance on Untrusted Inputs in a Security Decision (CWE-807)
2026-03-21 VulnCheck GHSA-hvgh-8gm9-9vq2
Denial Of Service Pidgin
6.9
CVSS 4.0 · NVD
Share

Severity by source

NVD PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
SUSE
6.2 MEDIUM
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat
6.2 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

7
CVSS changed
Apr 16, 2026 - 17:52 NVD
6.2 (MEDIUM) 6.9 (MEDIUM)
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
PoC Detected
Mar 23, 2026 - 14:31 vuln.today
Public exploit code
EUVD ID Assigned
Mar 21, 2026 - 13:00 euvd
EUVD-2019-19837
Analysis Generated
Mar 21, 2026 - 13:00 vuln.today
CVE Published
Mar 21, 2026 - 12:46 nvd
MEDIUM 6.2
CVE Published
Mar 21, 2026 - 12:46 cve.org
MEDIUM 6.9

DescriptionCVE.org

Pidgin 2.13.0 contains a denial of service vulnerability that allows local attackers to crash the application by providing an excessively long username string during account creation. Attackers can input a buffer of 1000 characters in the username field and trigger a crash when joining a chat, causing the application to become unavailable.

AnalysisAI

Pidgin 2.13.0 contains a denial of service vulnerability that allows local attackers to crash the application by providing an excessively long username string during account creation. Rated medium severity (CVSS 6.9), this vulnerability is no authentication required, low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified under CWE-807. Pidgin 2.13.0 contains a denial of service vulnerability that allows local attackers to crash the application by providing an excessively long username string during account creation. Attackers can input a buffer of 1000 characters in the username field and trigger a crash when joining a chat, causing the application to become unavailable. Affected products include: Pidgin.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Pidgin

View all
CVE-2013-6490 CRITICAL
10.0 Feb 06

The SIMPLE protocol functionality in Pidgin before 2.10.8 allows remote attackers to have an unspecified impact via a ne
CVE-2012-3374 HIGH POC
7.5 Jul 07

Buffer overflow in markup.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.5 allows remote attackers to

CVE-2013-6486 CRITICAL
9.3 Feb 06

gtkutils.c in Pidgin before 2.10.8 on Windows allows user-assisted remote attackers to execute arbitrary programs via a

CVE-2016-2376 HIGH
8.1 Jan 06

A buffer overflow vulnerability exists in the handling of the MXIT protocol in Pidgin. Rated high severity (CVSS 8.1), t
CVE-2016-2368 HIGH
8.1 Jan 06

Multiple memory corruption vulnerabilities exist in the handling of the MXIT protocol in Pidgin. Rated high severity (CV
CVE-2012-2318 MEDIUM POC
5.0 Jul 03

msg.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.4 does not properly handle crafted characters, which
CVE-2016-2371 HIGH
8.1 Jan 06

An out-of-bounds write vulnerability exists in the handling of the MXIT protocol in Pidgin. Rated high severity (CVSS 8.
CVE-2016-2378 HIGH
8.1 Jan 06

A buffer overflow vulnerability exists in the handling of the MXIT protocol Pidgin. Rated high severity (CVSS 8.1), this
CVE-2016-2377 HIGH
8.1 Jan 06

A buffer overflow vulnerability exists in the handling of the MXIT protocol in Pidgin. Rated high severity (CVSS 8.1), t
CVE-2016-2374 HIGH
8.1 Jan 06

An exploitable memory corruption vulnerability exists in the handling of the MXIT protocol in Pidgin. Rated high severit
CVE-2013-6487 HIGH
7.5 Feb 06

Integer overflow in libpurple/protocols/gg/lib/http.c in the Gadu-Gadu (gg) parser in Pidgin before 2.10.8 allows remote
CVE-2016-4323 LOW POC
3.7 Jan 06

A directory traversal exists in the handling of the MXIT protocol in Pidgin. Rated low severity (CVSS 3.7), this vulnera

Same weakness CWE-807 – Reliance on Untrusted Inputs in a Security Decision

View all
CVE-2026-21509 HIGH
7.8
CVE-2026-21514 HIGH
7.8
CVE-2025-13926 CRITICAL
9.3
CVE-2019-25711 MEDIUM POC
6.9
CVE-2019-25594 MEDIUM POC
6.9
CVE-2026-23848 MEDIUM POC
6.5
CVE-2025-65328 MEDIUM POC
6.5
CVE-2024-5754 MEDIUM POC
6.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Workstation Extension 15 SP7 Fixed

Share

CVE-2019-25544 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy