CVE-2010-10017
WM Downloader 3.1.2.2 Buffer Overflow via Malformed M3U File
- State
- Published
- Severity
- 8.4 High
- Published
- Aug 30, 2025
- Updated
- May 15, 2026
- Reserved
- Aug 28, 2025
Description
WM Downloader version 3.1.2.2 is vulnerable to a buffer overflow when processing a specially crafted .m3u playlist file. The application fails to properly validate input length, allowing an attacker to overwrite structured exception handler (SEH) records and execute arbitrary code. Exploitation occurs locally when a user opens the malicious file, and the payload executes with the privileges of the current user.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.4 High | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
WM DownloaderWM Downloader |
|
References
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/wm_downloader_m3u.rbexploit
- https://www.exploit-db.com/exploits/14497exploit
- https://www.exploit-db.com/exploits/16642exploit
- https://www.fortiguard.com/encyclopedia/ips/24038/wm-downloader-buffer-overflowthird-party-advisory
- https://www.vulncheck.com/advisories/wm-downloader-buffer-overflow-via-malformed-m3u-filethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.