How severe is CVE-2019-6453?

CVE-2019-6453 has a CVSS 3.x base score of 8.1, rated high severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2019-6453 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 72% (99th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2019-6453?

CVE-2019-6453 affects Mirc. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2019-6453?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2019-6453 published?

CVE-2019-6453 was published on 2019-02-18 and last updated on 2026-06-17.

CVE-2019-6453

CVE-2019-6453 is a high-severity vulnerability in Mirc with a CVSS 3.x base score of 8.1. Its EPSS exploit-prediction score of 72% places it in the 99th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-88.

Key facts

Severity: High (CVSS 3.x base score 8.1)
CVSS v2: 6.8
EPSS exploit prediction: 72% (99th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-88
Affected product: Mirc
Published: 2019-02-18
Last modified: 2026-06-17

Description

mIRC before 7.55 allows remote command execution by using argument injection through custom URI protocol handlers. The attacker can specify an irc:// URI that loads an arbitrary .ini file from a UNC share pathname. Exploitation depends on browser-specific URI handling (Chrome is not exploitable).

Frequently asked questions

What is CVE-2019-6453?: mIRC before 7.55 allows remote command execution by using argument injection through custom URI protocol handlers. The attacker can specify an irc:// URI that loads an arbitrary .ini file from a UNC share pathname. Exploitation depends on browser-specific URI handling (Chrome is not exploitable).
How severe is CVE-2019-6453?: CVE-2019-6453 has a CVSS 3.x base score of 8.1, rated high severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2019-6453 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 72% (99th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2019-6453?: CVE-2019-6453 affects Mirc. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2019-6453?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2019-6453 published?: CVE-2019-6453 was published on 2019-02-18 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:mirc:mirc:*:*:*:*:*:*:*:*

More vulnerabilities in Mirc

CVE-2008-4449 — Critical (CVSS 9.3): Stack-based buffer overflow in mIRC 6.34 allows remote attackers to execute arbitrary code via a long hostname in a…
CVE-2003-1336 — Critical (CVSS 9.3): Buffer overflow in mIRC before 6.11 allows remote attackers to execute arbitrary code via a long irc:// URL.
CVE-2008-7314 — High (CVSS 7.5): mIRC before 6.35 allows attackers to cause a denial of service (crash) via a long nickname.
CVE-2007-4402 — Medium (CVSS 6.8): Multiple unspecified scripts in mIRC allow user-assisted remote attackers to execute arbitrary code via the '|' (pipe)…
CVE-2011-5282 — Medium (CVSS 5.3): mIRC prior to 7.22 has a message leak because chopping of outbound messages is mishandled.
CVE-2003-1508 — Medium (CVSS 4.3): Buffer overflow in mIRC 6.12, when the DCC get dialog window has been minimized and the user opens the minimized…

All CVEs affecting Mirc →

Other CWE-88 (Argument Injection) vulnerabilities

CVE-2026-57572 — Critical (CVSS 10.0): Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, the Docker API server accepted…
CVE-2026-40281 — Critical (CVSS 10.0): Gotenberg is a Docker-powered stateless API for PDF files. In versions 8.30.1 and earlier, the metadata write endpoint…
CVE-2023-6269 — Critical (CVSS 10.0): An argument injection vulnerability has been identified in the administrative web interface of the Atos Unify…
CVE-2007-0882 — Critical (CVSS 10.0): Argument injection vulnerability in the telnet daemon (in.telnetd) in Solaris 10 and 11 (SunOS 5.10 and 5.11)…
CVE-2004-0480 — Critical (CVSS 10.0): Argument injection vulnerability in IBM Lotus Notes 6.0.3 and 6.5 allows remote attackers to execute arbitrary code via…
CVE-1999-0113 — Critical (CVSS 10.0): Some implementations of rlogin allow root access if given a -froot parameter.

Browse all CWE-88 (Argument Injection) vulnerabilities →