cbcvebase.
CVE-2019-5618
published 2020-04-29

CVE-2019-5618: A-PDF WAV to MP3 version 1.0.0 suffers from an instance of CWE-121: Stack-based Buffer Overflow.

PriorityP342high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EXPLOIT
EPSS
2.18%
80.1th percentile
A-PDF WAV to MP3 version 1.0.0 suffers from an instance of CWE-121: Stack-based Buffer Overflow.

Affected

1 ranges
VendorProductVersion rangeFixed in
a-pdfwav_to_mp3——

Detection & IOCsextracted from sources · hover to see the quote

versionA-PDF WAV to MP3 1.0.0↗
filename*.m3u↗
  • →Monitor for A-PDF WAV to MP3 v1.0.0 importing/opening .m3u files, which is the attack vector for this stack-based buffer overflow leading to arbitrary code execution. ↗
  • →This is a fileformat/client-side exploit; look for suspicious .m3u files delivered to systems running A-PDF WAV to MP3 v1.0.0 as the initial delivery mechanism. ↗
  • ·Exploitation is limited to A-PDF WAV to MP3 version 1.0.0 only; other versions are not confirmed vulnerable. ↗
  • ·This is a Windows fileformat exploit requiring user interaction — the victim must manually import the malicious .m3u file into the application. ↗

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.