CVE-2010-20111 Digital Music Pad <= 8.2.3.3.4 Stack Buffer Overflow
A stack buffer overflow in Digital Music Pad allows arbitrary code execution when a malicious .pls file is opened.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2010-20111?
CVE-2010-20111 is a high-severity memory corruption vulnerability in Digital Music Pad, published on 21 Aug 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Digital Music Pad v8.2.3.3.4 contains a stack-based buffer overflow vulnerability in its playlist file parser. When opening a .pls file containing an excessively long string in the File1 field, the application fails to properly validate input length, resulting in corruption of the Structured Exception Handler (SEH) on the stack. This flaw may allow an attacker to control execution flow when the file is opened, potentially leading to arbitrary code execution.
Weakness: CWE-121
Which versions are affected by CVE-2010-20111?
How do I fix CVE-2010-20111?
No fix has been published for CVE-2010-20111 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2010-20111 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2010-20111 exists.
Public exploit code: 1 Metasploit module.
Sources
Also known as GHSA-gf45-cpf5-g5rx.