CVE-2019-9766

HIGH

Free MP3 CD Ripper 2.6 - Buffer Overflow

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 3 public exploits for CVE-2019-9766. PoCs published by Gionathan Reale, zeronohacker, moonheadobj.

AI-analyzed exploit summary This exploit leverages a buffer overflow vulnerability in Free MP3 CD Ripper 2.6 by overwriting the SEH handler to execute arbitrary shellcode, resulting in a calculator popup as a demonstration of code execution.

Description

Stack-based buffer overflow in Free MP3 CD Ripper 2.6, when converting a file, allows user-assisted remote attackers to execute arbitrary code via a crafted .mp3 file.

Exploits (3)

exploitdb WORKING POC VERIFIED
by Gionathan Reale · pythonlocalwindows_x86
https://www.exploit-db.com/exploits/45403

This exploit leverages a buffer overflow vulnerability in Free MP3 CD Ripper 2.6 by overwriting the SEH handler to execute arbitrary shellcode, resulting in a calculator popup as a demonstration of code execution.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Free MP3 CD Ripper 2.6
No auth needed
Prerequisites: Victim must open the malicious .mp3 file in the vulnerable software
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 1 stars
by zeronohacker · poc
https://github.com/zeronohacker/CVE-2019-9766

This repository contains a working proof-of-concept exploit for CVE-2019-9766, a stack-based buffer overflow vulnerability in Free MP3 CD Ripper 2.6. The exploit constructs a malicious MP3 file that, when played, executes arbitrary shellcode to achieve remote code execution (RCE) via a reverse TCP shell.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Free MP3 CD Ripper 2.6
No auth needed
Prerequisites: Kali Linux (preferably 2019 version) · Metasploit Framework · Windows 10 21H1 target · Free MP3 CD Ripper 2.6 installed on the target
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 1 stars
by moonheadobj · poc
https://github.com/moonheadobj/CVE-2019-9766

This repository contains a working proof-of-concept exploit for CVE-2019-9766, a stack-based buffer overflow vulnerability in Free MP3 CD Ripper 2.6. The exploit generates a malicious .mp3 file that, when processed by the vulnerable software, executes a reverse shell payload.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Free MP3 CD Ripper 2.6
No auth needed
Prerequisites: Attacker needs to deliver the malicious .mp3 file to the target system running Free MP3 CD Ripper 2.6
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1
Core References
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/45403

Scores

CVSS v3 7.8
EPSS 0.0796
EPSS Percentile 94.0%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-787
Status published
Products (1)
cleanersoft/free_mp3_cd_ripper 2.6
Published Mar 14, 2019
Tracked Since Feb 18, 2026