How severe is CVE-2019-25548?

CVE-2019-25548 has a CVSS 3.x base score of 6.2, rated medium severity. It is exploitable over local access with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2019-25548 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (6th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2019-25548?

CVE-2019-25548 affects Bluestacks. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2019-25548?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2019-25548 have an EU (EUVD) identifier?

Yes. CVE-2019-25548 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2019-19844.

When was CVE-2019-25548 published?

CVE-2019-25548 was published on 2026-03-21 and last updated on 2026-06-17.

CVE-2019-25548

CVE-2019-25548 is a medium-severity vulnerability in Bluestacks with a CVSS 3.x base score of 6.2. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-466.

Key facts

Severity: Medium (CVSS 3.x base score 6.2)
CVSS v4: 6.9
EPSS exploit prediction: 0% (6th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2019-19844
Weakness: CWE-466
Affected product: Bluestacks
Published: 2026-03-21
Last modified: 2026-06-17

Description

BlueStacks 4.80.0.1060 contains a denial of service vulnerability that allows local attackers to crash the application by submitting oversized input to the search field. Attackers can paste a buffer of 100,000 'A' characters into the search field and trigger a search operation to cause the application to crash.

Frequently asked questions

What is CVE-2019-25548?: BlueStacks 4.80.0.1060 contains a denial of service vulnerability that allows local attackers to crash the application by submitting oversized input to the search field. Attackers can paste a buffer of 100,000 'A' characters into the search field and trigger a search operation to cause the application to crash.
How severe is CVE-2019-25548?: CVE-2019-25548 has a CVSS 3.x base score of 6.2, rated medium severity. It is exploitable over local access with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2019-25548 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (6th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2019-25548?: CVE-2019-25548 affects Bluestacks. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2019-25548?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2019-25548 have an EU (EUVD) identifier?: Yes. CVE-2019-25548 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2019-19844.
When was CVE-2019-25548 published?: CVE-2019-25548 was published on 2026-03-21 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:bluestacks:bluestacks:4.80.0.1060:*:*:*:*:*:*:*

More vulnerabilities in Bluestacks

CVE-2018-0701 — High (CVSS 8.8): BlueStacks App Player (BlueStacks App Player for Windows 3.0.0 to 4.31.55, BlueStacks App Player for macOS 2.0.0 and…
CVE-2016-4288 — High (CVSS 8.4): A local privilege escalation vulnerability exists in BlueStacks App Player. The BlueStacks App Player installer creates…
CVE-2020-24367 — High (CVSS 7.8): Incorrect file permissions in BlueStacks 4 through 4.230 on Windows allow a local attacker to escalate privileges by…
CVE-2019-14220 — Medium (CVSS 6.5): An issue was discovered in BlueStacks 4.110 and below on macOS and on 4.120 and below on Windows. BlueStacks employs…
CVE-2025-44964 — Low (CVSS 3.9): A lack of SSL certificate validation in BlueStacks v5.20 allows attackers to execute a man-it-the-middle attack and…

All CVEs affecting Bluestacks →

Other CWE-466 vulnerabilities

CVE-2024-21849 — High (CVSS 7.5): When an Advanced WAF/ASM security policy and a Websockets profile are configured on a virtual server, undisclosed…
CVE-2024-33602 — High (CVSS 7.4): nscd: netgroup cache assumes NSS callback uses in-buffer strings The Name Service Cache Daemon's (nscd) netgroup cache…
CVE-2018-25234 — Medium (CVSS 6.2): SmartFTP Client 9.0.2615.0 contains a denial of service vulnerability that allows local attackers to crash the…
CVE-2018-25227 — Medium (CVSS 6.2): Valentina Studio 9.0.4 contains a denial of service vulnerability that allows local attackers to crash the application…
CVE-2019-25599 — Medium (CVSS 6.2): Backup Key Recovery 2.2.4 contains a denial of service vulnerability that allows local attackers to crash the…
CVE-2019-25586 — Medium (CVSS 6.2): Deluge 1.3.15 contains a denial of service vulnerability that allows local attackers to crash the application by…

Browse all CWE-466 vulnerabilities →