$ cve CVE-2009-0950 JSON

CVE-2009-0950 EXPLOIT

9.3

HIGH · CVSS 2.0 · EPSS 28.8% (pctl 98)

Patch early

A public exploit exists.

Description

Stack-based buffer overflow in Apple iTunes before 8.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via an itms: URL with a long URL component after a colon.

Scoring

CVSS	9.3 (HIGH, v2.0)
Vector	AV:N/AC:M/Au:N/C:C/I:C/A:C
EPSS	28.82% — more likely to be exploited than 98% of all CVEs
Weakness	CWE-119
On CISA KEV	no
Public exploit	yes
Published	2009-06-02
Last modified	2026-06-16

Affected (1)

Vendor	Product
apple	itunes

Public exploits

Source	Title	Date
exploit-db	Apple iTunes 8.1.1 (Mac OSX) - ITms Overflow (Metasploit)	2010-11-11
exploit-db	Apple iTunes 8.1.x - 'daap' Remote Buffer Overflow	2010-01-14
exploit-db	Apple iTunes 8.1.1.10 (Windows) - 'itms/itcp' Remote Buffer Overflow	2009-06-12
exploit-db	Apple iTunes 8.1.1 - 'ITMS' Multiple Protocol Handler Buffer Overflow (Metasploit)	2009-06-03

References

→ the Explorer · watch your stack · NVD