CVE-2011-10027

published 2025-08-20

CVE-2011-10027: AOL Desktop 9.6 contains a buffer overflow vulnerability in its Tool\rich.rct component when parsing .rtx files. By embedding an overly long string in a…

Priority P3 49 high 8.4 CVSS 4.0

AV L AC L AT N PR N UI A VC H VI H VA H SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

EXPLOIT

AOL Desktop 9.6 contains a buffer overflow vulnerability in its Tool\rich.rct component when parsing .rtx files. By embedding an overly long string in a hyperlink tag, an attacker can trigger a stack-based buffer overflow due to the use of unsafe strcpy operations. This allows remote attackers to execute arbitrary code when a victim opens a malicious .rtx file. AOL Desktop is end-of-life and no longer supported. Users are encouraged to migrate to AOL Desktop Gold or alternative platforms.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
aol_inc	aol_desktop	<= 9.6	—

Detection & IOCs extracted from sources · hover to see the quote

filename Tool\rich.rct↗

• → Monitor for AOL Desktop processes opening .rtx files, particularly where rich.rct is loaded and processes unusually large hyperlink tag strings — indicative of the strcpy-based stack buffer overflow trigger. ↗
• → Flag delivery or opening of .rtx files in email or web contexts targeting AOL Desktop 9.6 users, as the exploit vector is a malicious .rtx file with an overly long hyperlink tag string. ↗
• → The Metasploit module for this CVE is a Windows fileformat exploit targeting AOL Desktop 9.6; detect use of the module path exploits/windows/fileformat/aol_desktop_linktag in offensive tooling or logs. ↗

• · AOL Desktop 9.6 is end-of-life with no vendor patch available; the only mitigation is migration away from the affected software. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-121