CVE-2010-5236

Roxio Easy Media Creator Home 9.0.136 - Privilege Escalation

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2010-5236. PoCs published by storm.

AI-analyzed exploit summary This exploit leverages DLL hijacking in Roxio Creator DE by providing a malicious HomeUtils9.dll that executes arbitrary code (calc.exe) when loaded. It targets vulnerable file associations (.c2d, .gi, .roxio).

Description

Untrusted search path vulnerability in Roxio Easy Media Creator Home 9.0.136 allows local users to gain privileges via a Trojan horse homeutils9.dll file in the current working directory, as demonstrated by a directory that contains a .roxio, .c2d, or .gi file. NOTE: some of these details are obtained from third party information.

Exploits (1)

exploitdb WORKING POC
by storm · clocalwindows
https://www.exploit-db.com/exploits/14768

This exploit leverages DLL hijacking in Roxio Creator DE by providing a malicious HomeUtils9.dll that executes arbitrary code (calc.exe) when loaded. It targets vulnerable file associations (.c2d, .gi, .roxio).

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: Roxio Creator DE 9.0.116
No auth needed
Prerequisites: Victim must open a file with an affected extension (.c2d, .gi, .roxio) in a directory where the malicious DLL is placed
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2
Core References
Exploit exploit x_refsource_exploit-db
http://www.exploit-db.com/exploits/14768
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/41137

Scores

EPSS 0.0102
EPSS Percentile 58.6%

Details

Status published
Products (1)
roxio/easy_media_creator 9.0.136
Published Sep 07, 2012
Tracked Since Feb 18, 2026