CVE-2010-10017
HIGHWM Downloader 3.1.2.2 - Buffer Overflow
Title source: llmDescription
WM Downloader version 3.1.2.2 is vulnerable to a buffer overflow when processing a specially crafted .m3u playlist file. The application fails to properly validate input length, allowing an attacker to overwrite structured exception handler (SEH) records and execute arbitrary code. Exploitation occurs locally when a user opens the malicious file, and the payload executes with the privileges of the current user.
Exploits (3)
exploitdb
WORKING POC
VERIFIED
by Metasploit · rubylocalwindows
https://www.exploit-db.com/exploits/16642
exploitdb
WORKING POC
VERIFIED
by fdiskyou · pythonlocalwindows
https://www.exploit-db.com/exploits/14497
metasploit
WORKING POC
NORMAL
by fdisk, dookie · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/wm_downloader_m3u.rb
References (5)
Scores
CVSS v4
8.4
EPSS
0.0815
EPSS Percentile
92.2%
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
total
Details
CWE
CWE-120
CWE-134
Status
published
Products (1)
WM Downloader/WM Downloader
< 3.1.2.2
Published
Aug 30, 2025
Tracked Since
Feb 18, 2026