CVE-2019-25572

MediumCVSS 6.2

Published: 21/03/2026(UTC)Updated: 07/10/2026(UTC)Translated: 07/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

4th percentile - higher than 4% of all known CVEs

Summary

NordVPN 6.19.6 contains a denial of service vulnerability that allows local attackers to crash the application by submitting an excessively long string in the email input field. Attackers can paste a buffer of 100,000 characters into the email field during login to trigger an application crash.

Risk Assessment

A local attacker can cause the application to crash, which may disrupt user operations and potentially enable further attacks on the system.

Recommendation

Update NordVPN to the latest version that includes a fix for the denial of service vulnerability.

Other vulnerabilities in NordVPN

CVE-2026-106030Medium
NordVPN for Windows allows local attackers to stop unprotected Windows system services and change their startup type to Manual via named pipes. The NordVPN user-mode application allows a low-privileged attacker to act as a trusted process and connect to the named pipe "\\.\pipe\nord-security\v1\NordVpnService\Server". The attacker can then invoke the "ISettingsGrpc.StopService" and "ISettingsGrpc.ChangeServiceStartType" methods with an arbitrary service name, leading to denial of service of critical system services. Services protected by Windows (PPL processes, Windows Tamper Protection), such as Windows Defender, cannot be stopped or reconfigured. This issue was fixed in version 8.12.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS