CVE-2011-5003

Avid Media Composer < 5.5.3 - Remote Code Execution via Phonetic Indexer Long Request

Title source: llm

Exploitation Summary

EIP tracks 2 public exploits for CVE-2011-5003. PoCs published by Nick Freeman, including Metasploit module exploits/windows/misc/avidphoneticindexer.

AI-analyzed exploit summary This is a Metasploit module exploiting a stack buffer overflow in AvidPhoneticIndexer.exe (port 4659) in Avid Media Composer 5.5. It uses a SEH pivot and ROP chain to achieve arbitrary code execution.

Description

Stack-based buffer overflow in the Phonetic Indexer (AvidPhoneticIndexer.exe) in Avid Media Composer 5.5.3 and earlier allows remote attackers to execute arbitrary code via a long request to TCP port 4659.

Exploits (2)

exploitdb WORKING POC VERIFIED

by Nick Freeman · rubyremotewindows

https://www.exploit-db.com/exploits/18183

View Code ZIP pw:eip

This is a Metasploit module exploiting a stack buffer overflow in AvidPhoneticIndexer.exe (port 4659) in Avid Media Composer 5.5. It uses a SEH pivot and ROP chain to achieve arbitrary code execution.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: Avid Media Composer <= 5.5.3

No auth needed

Prerequisites: Network access to the vulnerable service on port 4659 or 4660

MITRE ATT&CK

T1068 - Exploitation for Privilege Escalation T1203 - Exploitation for Client Execution

devstral-2 · analyzed Feb 16, 2026 Full analysis →

metasploit WORKING POC NORMAL

rubypocwin

https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/misc/avidphoneticindexer.rb

View Code ZIP pw:eip

This Metasploit module exploits a stack buffer overflow in AvidPhoneticIndexer.exe (port 4659) by sending a crafted payload to achieve remote code execution. It uses a ROP chain to bypass DEP and execute shellcode.