CVE-2011-10024

MJM Core Player (likely now referred to as MJM Player) 2011 is vulnerable to a stack-based buffer overflow when parsing specially crafted .s3m music files. The vulnerability arises from improper bounds checking in the file parser, allowing an attacker to overwrite memory on the stack and execute arbitrary code. Exploitation is triggered when a user opens a malicious .s3m file, and the exploit bypasses DEP and ASLR protections using a ROP chain.

• CWE-121

• https://mjm-software.com
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/mjm_coreplayer2011_s3m.rb
• https://web.archive.org/web/20111016195816/https://www.corelan.be/index.php/forum/security-advisories/corelan-11-004-mjm-core-multimedia-suite-2011-2-4-stack-buffer-overflow-s3m/
• https://www.exploit-db.com/exploits/17230
• https://www.vulncheck.com/advisories/mjm-core-player-file-stack-based-buffer-overflow
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/mjm_coreplayer2011_s3m.rb
• https://www.exploit-db.com/exploits/17230

Published

Aug 20, 2025

Last Modified

Jun 16, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2011-10019Spreecommerce versions prior to 0.60.2 contains a remote com…9.8
• CVE-2011-1002avahi-core/socket.c in avahi-daemon in Avahi before 0.6.29 a…
• CVE-2011-10020Kaillera Server version 0.86 is vulnerable to a denial-of-se…8.7
• CVE-2011-10021Magix Musik Maker 16 is vulnerable to a stack-based buffer o…8.4
• CVE-2011-10022SPlayer version 3.7 and earlier is vulnerable to a stack-bas…8.6
• CVE-2011-10023MJM QuickPlayer (also known as MJM Player) version 2010 cont…8.4
• CVE-2011-10025Subtitle Processor 7.7.1 contains a buffer overflow vulnerab…8.5
• CVE-2011-10026Spreecommerce versions prior to 0.50.x contain a remote comm…9.8
• CVE-2011-10027AOL Desktop 9.6 contains a buffer overflow vulnerability in …8.4
• CVE-2011-10028The RealNetworks RealArcade platform includes an ActiveX con…8.7
• CVE-2011-10029Solar FTP Server fails to properly handle format strings pas…8.7
• CVE-2011-1003Double free vulnerability in the vba_read_project_strings fu…