CVE-2019-25572CWE-1260

CVE-2019-25572

Medium · published March 21, 2026

CVSS v3.1

6.2

EPSS

Percentile

4.7

In the wild

Unconfirmed

What it is

NordVPN 6.19.6 contains a denial of service vulnerability that allows local attackers to crash the application by submitting an excessively long string in the email input field. Attackers can paste a buffer of 100,000 characters into the email field during login to trigger an application crash.

The record

Technical detail

CVSS v3.1: 6.2 · MEDIUM
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0: Not supplied
EPSS: 0.00160 · 4.7th percentile
Weakness: CWE-1260 · Improper Handling of Overlap Between Protected Memory Ranges
Published: 2026-03-21T17:16Z

Affected products (1)

Product	Versions	Fixed in
nordvpn/nordvpn	≤ 6.19.6	—

References (4)

https://downloads.nordcdn.com/apps/windows/10/NordVPN/latest/NordVPNSetup.exe · [email protected]https://nordvpn.com/ · [email protected]https://www.exploit-db.com/exploits/46343 · [email protected]https://www.vulncheck.com/advisories/nordvpn-denial-of-service-via-email-field-buffer-overflow · [email protected]

EPSS history

Timeline

21 MAR 12:47Z
NordVPN 6.19.6 Denial of Service via Email Field Buffer Overflow
cvelistv5