CVE-2008-4449

mIRC 6.34 - Remote Code Execution via Long Hostname in PRIVMSG

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 4 public exploits for CVE-2008-4449. PoCs published by Metasploit, SkD, securfrog, including Metasploit module exploits/windows/misc/mirc_privmsg_server.

AI-analyzed exploit summary This Metasploit module exploits a stack-based buffer overflow in mIRC <= 6.34 via an excessively long PRIVMSG command. It leverages SEH overwrites and a JMP ESP technique to achieve remote code execution.

Description

Stack-based buffer overflow in mIRC 6.34 allows remote attackers to execute arbitrary code via a long hostname in a PRIVMSG message.

Exploits (4)

exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotewindows
https://www.exploit-db.com/exploits/16422

This Metasploit module exploits a stack-based buffer overflow in mIRC <= 6.34 via an excessively long PRIVMSG command. It leverages SEH overwrites and a JMP ESP technique to achieve remote code execution.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: mIRC <= 6.34
No auth needed
Prerequisites: Victim must connect to a malicious IRC server controlled by the attacker
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by SkD · perlremotewindows
https://www.exploit-db.com/exploits/6666

This exploit targets a remote buffer overflow in mIRC 6.34 by sending a maliciously crafted IRC message to trigger a SEH overwrite and execute shellcode. It includes different return addresses for Windows XP SP3 and Vista SP0.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: mIRC 6.34
No auth needed
Prerequisites: Network access to the target's IRC port · Target must be running mIRC 6.34
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by securfrog · perldoswindows
https://www.exploit-db.com/exploits/6654

This exploit demonstrates a remote buffer overflow in mIRC 6.34 by sending a malformed PRIVMSG command with a long string of 'A's followed by two controlled bytes. It sets up a fake IRC server to trigger the vulnerability when a victim connects.

Classification
Working Poc 90%
Attack Type
Dos
Complexity
Trivial
Reliability
Reliable
Target: mIRC 6.34
No auth needed
Prerequisites: Victim must connect to the attacker's IRC server · mIRC 6.34 must be in use
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC NORMAL
by aushack · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/misc/mirc_privmsg_server.rb

This Metasploit module exploits a stack-based buffer overflow in mIRC IRC Client v6.34 and earlier by sending an excessively long PRIVMSG command, allowing remote code execution. The exploit uses SEH overwrites and a JMP ESP technique to redirect execution to the payload.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: mIRC IRC Client v6.34 and earlier
No auth needed
Prerequisites: Victim must connect to a malicious IRC server controlled by the attacker
devstral-2 · analyzed Feb 19, 2026 Full analysis →

References (7)

Core 7
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/45624
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/6654
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/32102
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/6666
Third Party Advisory third-party-advisory x_refsource_sreason
http://securityreason.com/securityalert/4352
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2008/2736
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/31552

Scores

EPSS 0.3874
EPSS Percentile 98.4%

Details

CWE
CWE-119
Status published
Products (1)
mirc/mirc 6.34
Published Oct 06, 2008
Tracked Since Feb 18, 2026