CVE-2010-10017

WM Downloader version 3.1.2.2 is vulnerable to a buffer overflow when processing a specially crafted .m3u playlist file. The application fails to properly validate input length, allowing an attacker to overwrite structured exception handler (SEH) records and execute arbitrary code. Exploitation occurs locally when a user opens the malicious file, and the payload executes with the privileges of the current user.

• CWE-120
• CWE-134

• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/wm_downloader_m3u.rb
• https://www.exploit-db.com/exploits/14497
• https://www.exploit-db.com/exploits/16642
• https://www.fortiguard.com/encyclopedia/ips/24038/wm-downloader-buffer-overflow
• https://www.vulncheck.com/advisories/wm-downloader-buffer-overflow-via-malformed-m3u-file

Published

Aug 30, 2025

Last Modified

Jun 16, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2010-10011A vulnerability, which was classified as problematic, was fo…7.5
• CVE-2010-10012A path traversal vulnerability exists in httpdasm version 0.…8.7
• CVE-2010-10013An unauthenticated remote command execution vulnerability ex…9.3
• CVE-2010-10014Odin Secure FTP <= 4.1 is vulnerable to a stack-based buffer…8.7
• CVE-2010-10015AOL versions up to and including 9.5 includes an ActiveX con…8.4
• CVE-2010-10016BS.Player version 2.57 (build 1051) contains a vulnerability…10
• CVE-2010-1003Directory traversal vulnerability in www/editor/tiny_mce/lan…
• CVE-2010-1004SQL injection vulnerability in the Yet another TYPO3 search …
• CVE-2010-1005Cross-site scripting (XSS) vulnerability in the Yet another …
• CVE-2010-1006SQL injection vulnerability in the Brainstorming extension 0…
• CVE-2010-1007Unspecified vulnerability in the Power Extension Manager (ch…
• CVE-2010-1008Cross-site scripting (XSS) vulnerability in the Sellector.co…