CVE-2018-25304

HIGH

Free Download Manager 2.0 Built 417 Local Buffer Overflow SEH

Title source: cna

Exploitation Summary

EIP tracks 1 public exploit for CVE-2018-25304. PoCs published by Marwan Shamel.

AI-analyzed exploit summary This exploit demonstrates a local buffer overflow vulnerability in Free Download Manager 2.0 Built 417 via a crafted HTTP response. It leverages SEH (Structured Exception Handler) overwrite with a short jump and shellcode to achieve arbitrary code execution.

Description

Free Download Manager 2.0 Build 417 contains a local buffer overflow vulnerability in the URL import functionality that allows attackers to trigger a structured exception handler (SEH) chain exploitation. Attackers can craft a malicious URL file that, when imported through the File > Import > Import lists of downloads menu, causes a buffer overflow in the Location header response that overwrites the SEH chain and executes arbitrary code.

Exploits (1)

exploitdb WORKING POC

by Marwan Shamel · pythonlocalwindows_x86

https://www.exploit-db.com/exploits/44499

View Code ZIP pw:eip

This exploit demonstrates a local buffer overflow vulnerability in Free Download Manager 2.0 Built 417 via a crafted HTTP response. It leverages SEH (Structured Exception Handler) overwrite with a short jump and shellcode to achieve arbitrary code execution.

Classification

Working Poc 100%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: Free Download Manager v2.0 Built 417

No auth needed

Prerequisites: Network access to the target · Victim must import a malicious URL list

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1059 - Command and Scripting Interpreter T1203 - Exploitation for Client Execution

devstral-2 · analyzed Apr 30, 2026 Full analysis →

References (3)

Core 3

Core References

Exploit exploit

ExploitDB-44499

https://www.exploit-db.com/exploits/44499

Product product

Product Reference

https://filehippo.com/download_free_download_manager/925/

Third Party Advisory third-party-advisory

VulnCheck Advisory: Free Download Manager 2.0 Built 417 Local Buffer Overflow SEH

https://www.vulncheck.com/advisories/free-download-manager-built-417-local-buffer-overflow-seh

Scores

CVSS v3 8.4

EPSS 0.0015

EPSS Percentile 4.8%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact total

Details

CWE

CWE-120

Status published

Products (1)

Filehippo/Free Download Manager 2.0

Published Apr 29, 2026

Tracked Since Apr 30, 2026