CVE-2010-10015

published 2025-08-21

CVE-2010-10015: AOL versions up to and including 9.5 includes an ActiveX control (Phobos.dll) that exposes a method called Import() via the Phobos.Playlist COM object. This…

Priority P3 47 high 8.4 CVSS 4.0

AV L AC L AT N PR N UI A VC H VI H VA H SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

EXPLOIT

AOL versions up to and including 9.5 includes an ActiveX control (Phobos.dll) that exposes a method called Import() via the Phobos.Playlist COM object. This method is vulnerable to a stack-based buffer overflow when provided with an excessively long string argument. Exploitation allows remote attackers to execute arbitrary code in the context of the user, but only when the malicious HTML file is opened locally, due to the control not being marked safe for scripting or initialization. AOL remains an active and supported brand offering services like AOL Mail and AOL Desktop Gold, but the legacy AOL 9.5 desktop software—specifically the version containing the vulnerable Phobos.dll ActiveX control—is long discontinued and no longer maintained.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
aol	aol	<= 9.5 (Revision 4337.155)	—

Detection & IOCs extracted from sources · hover to see the quote

filename Phobos.dll↗

other Phobos.Playlist↗

command Import()↗

• → Monitor for instantiation of the Phobos.Playlist COM/ActiveX object (Phobos.dll) in browser or HTML file contexts, particularly when the Import() method is called with an unusually long string argument indicative of a stack-based buffer overflow attempt. ↗
• → Flag local HTML file execution that instantiates the Phobos.Playlist ActiveX control; exploitation requires the malicious HTML to be opened locally due to the control not being marked safe for scripting or initialization. ↗
• → Detect file-format exploit delivery via Metasploit module targeting AOL 9.5 Phobos.dll; look for generated malicious HTML/file artifacts associated with the aol_phobos_bof module. ↗

• · The ActiveX control is NOT marked safe for scripting or initialization, meaning exploitation is limited to locally opened malicious HTML files and cannot be triggered via a remote/web-based drive-by attack. ↗
• · The vulnerable AOL 9.5 desktop software containing Phobos.dll is long discontinued and no longer maintained, significantly limiting the active attack surface. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-121