Digital Music Pad up to 8.2.3.3.4 pls File File1 stack-based overflow

Summaryinfo

A vulnerability classified as critical has been found in Digital Music Pad up to 8.2.3.3.4. Impacted is an unknown function of the component pls File Handler. The manipulation of the argument File1 leads to stack-based overflow. This vulnerability only affects products that are no longer supported by the maintainer. This vulnerability is listed as CVE-2010-20111. The attack may be initiated remotely. In addition, an exploit is available.

Detailsinfo

A vulnerability was found in Digital Music Pad up to 8.2.3.3.4 and classified as critical. This issue affects some unknown processing of the component pls File Handler. The manipulation of the argument File1 with an unknown input leads to a stack-based overflow vulnerability. Using CWE to declare the problem leads to CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Digital Music Pad v8.2.3.3.4 contains a stack-based buffer overflow vulnerability in its playlist file parser. When opening a .pls file containing an excessively long string in the File1 field, the application fails to properly validate input length, resulting in corruption of the Structured Exception Handler (SEH) on the stack. This flaw may allow an attacker to control execution flow when the file is opened, potentially leading to arbitrary code execution.

The weakness was presented by Abhishek Lyall. It is possible to read the advisory at web.archive.org. The identification of this vulnerability is CVE-2010-20111 since 08/20/2025. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details as well as a public exploit are known.

The exploit is available at exploit-db.com. It is declared as proof-of-concept.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Exploit-DB (15134). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• Digital Music Pad

Version

• 8.2.3.3.0
• 8.2.3.3.1
• 8.2.3.3.2
• 8.2.3.3.3
• 8.2.3.3.4

Support

• end of life

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion