Is CVE-2019-25345 actively exploited?

A weaponized exploit exists for CVE-2019-25345, making exploitation likely. It is not yet confirmed in the CISA KEV catalog.

Can CVE-2019-25345 be exploited remotely?

No. CVE-2019-25345 requires local access to exploit.

What is the CVSS score of CVE-2019-25345?

CVE-2019-25345 has a CVSS score of 7.8 (HIGH) and an EPSS exploitation probability of 0.01%.

HOME VULNERABILITIESCVE-2019-25345

HIGHWEAPONIZED

CVE-2019-25345

CWE-428Published: February 12, 2026· Updated: Feb 13, 2026

7.8

CVSS v3.1

EPSS:0.01%probability of exploitation in 30 daysPercentile:2.1th

Official Description

Realtek IIS Codec Service 6.4.10041.133 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in the service configuration to inject malicious executables and escalate privileges on the system.

NVD Source

Technical Analysis

CVE-2019-25345 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 7.8.

A weaponized exploit for CVE-2019-25345 is publicly known. This significantly lowers the barrier for threat actors and increases the urgency for remediation.