R-Project

5 CVEs in 4 R-Project products, including R, Cran, Rgui. Newest: CVE-2019-25695 (2026-04-12). Severity, EPSS and public exploits for each.

R-Project products with known CVEs

ProductCVEs
R2
Cran1
Rgui1
R I3861
R-Project CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2019-25695High8.42026-04-12R 3.4.4 contains a local buffer overflow vulnerability that allows attackers to execute arbitrary code by injecting malicious input into the GUI Preferences la…
CVE-2018-25258High8.42026-04-12RGui 3.5.0 contains a local buffer overflow vulnerability in the GUI preferences dialog that allows attackers to bypass DEP protections through structured exce…
CVE-2019-25656High8.42026-04-05R i386 3.5.0 contains a local buffer overflow vulnerability in the GUI Preferences dialog that allows local attackers to trigger a structured exception handler…
CVE-2019-25485Medium6.22026-03-11R 3.4.4 on Windows x64 contains a buffer overflow vulnerability in the GUI Preferences language menu field that allows local attackers to bypass DEP and ASLR p…
CVE-2020-27637Critical9.82021-01-12The R programming language’s default package manager CRAN is affected by a path traversal vulnerability that can lead to server compromise. This vulnerability…