CVE-2013-1017

Apple QuickTime < 7.7.4 - Remote Code Execution via Crafted Dref Atoms

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 3 public exploits for CVE-2013-1017. PoCs published by Metasploit, Jason Kratzer, Tom Gallagher, Paul Bates, sinn3r, including Metasploit module exploits/windows/browser/apple_quicktime_rdrf.

AI-analyzed exploit summary This Metasploit module exploits a buffer overflow in Apple Quicktime 7 by crafting a malicious .mov file with an invalid atom length, leading to arbitrary code execution via a ROP chain and heap spray.

Description

Buffer overflow in Apple QuickTime before 7.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted dref atoms in a movie file.

Exploits (3)

exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotewindows
https://www.exploit-db.com/exploits/27012

This Metasploit module exploits a buffer overflow in Apple Quicktime 7 by crafting a malicious .mov file with an invalid atom length, leading to arbitrary code execution via a ROP chain and heap spray.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Complex
Reliability
Reliable
Target: Apple Quicktime 7.7.0-7.7.3
No auth needed
Prerequisites: Victim must open a malicious .mov file in a vulnerable version of Quicktime
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC NORMAL
by Jason Kratzer, Tom Gallagher, Paul Bates, sinn3r · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/apple_quicktime_rdrf.rb

This Metasploit module exploits a buffer overflow in Apple Quicktime 7 by crafting a malicious .mov file with an invalid 'rdrf' atom length, leading to arbitrary code execution via a ROP chain and heap spray.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Apple Quicktime 7.7.0-7.7.3
No auth needed
Prerequisites: Victim must open a malicious .mov file via a web browser with Quicktime plugin
devstral-2 · analyzed Feb 19, 2026 Full analysis →
metasploit WORKING POC NORMAL
by Jason Kratzer, Tom Gallagher, Paul Bates, sinn3r · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/apple_quicktime_rdrf.rb

This Metasploit module exploits a buffer overflow in Apple QuickTime (CVE-2013-1017) by crafting a malicious .mov file with an invalid 'rdrf' atom length, leading to arbitrary code execution via an egghunter technique.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Apple QuickTime 7.7.0 - 7.7.3 on Windows XP SP3
No auth needed
Prerequisites: Victim must open the malicious .mov file in a vulnerable version of QuickTime
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Vendor Advisory vendor-advisory x_refsource_apple
http://lists.apple.com/archives/security-announce/2013/May/msg00001.html
Vendor Advisory x_refsource_confirm
http://support.apple.com/kb/HT5770
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16606

Scores

EPSS 0.3255
EPSS Percentile 98.1%

Details

CWE
CWE-119
Status published
Products (50)
apple/quicktime 3.0
apple/quicktime 4.1.2
apple/quicktime 5.0
apple/quicktime 5.0.1
apple/quicktime 5.0.2
apple/quicktime 6.0
apple/quicktime 6.0.0
apple/quicktime 6.0.1
apple/quicktime 6.0.2
apple/quicktime 6.1
... and 40 more
Published May 24, 2013
Tracked Since Feb 18, 2026