CVE-2011-10023

MJM QuickPlayer (also known as MJM Player) version 2010 contains a stack-based buffer overflow vulnerability triggered by opening a malicious .s3m music file. The flaw occurs due to improper bounds checking in the file parser, allowing an attacker to overwrite memory and execute arbitrary code. Exploitation is achieved via a crafted payload that bypasses DEP and ASLR protections using ROP techniques, and requires user interaction to open the file.

• CWE-121

• https://mjm-software.com
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/mjm_quickplayer_s3m.rb
• https://web.archive.org/web/20111016194042/https://www.corelan.be/index.php/forum/security-advisories/corelan-11-003-mjm-quickplayer-2-3-2010-stack-buffer-overflow-s3m/
• https://www.exploit-db.com/exploits/17229
• https://www.vulncheck.com/advisories/mjm-quickplayer-s3m-stack-based-buffer-overflow
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/mjm_quickplayer_s3m.rb
• https://www.exploit-db.com/exploits/17229

Published

Aug 20, 2025

Last Modified

Jun 16, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2011-10018myBB version 1.6.4 was distributed with an unauthorized back…9.8
• CVE-2011-10019Spreecommerce versions prior to 0.60.2 contains a remote com…9.8
• CVE-2011-1002avahi-core/socket.c in avahi-daemon in Avahi before 0.6.29 a…
• CVE-2011-10020Kaillera Server version 0.86 is vulnerable to a denial-of-se…8.7
• CVE-2011-10021Magix Musik Maker 16 is vulnerable to a stack-based buffer o…8.4
• CVE-2011-10022SPlayer version 3.7 and earlier is vulnerable to a stack-bas…8.6
• CVE-2011-10024MJM Core Player (likely now referred to as MJM Player) 2011 …8.4
• CVE-2011-10025Subtitle Processor 7.7.1 contains a buffer overflow vulnerab…8.5
• CVE-2011-10026Spreecommerce versions prior to 0.50.x contain a remote comm…9.8
• CVE-2011-10027AOL Desktop 9.6 contains a buffer overflow vulnerability in …8.4
• CVE-2011-10028The RealNetworks RealArcade platform includes an ActiveX con…8.7
• CVE-2011-10029Solar FTP Server fails to properly handle format strings pas…8.7