CVE-2010-0480 EXPLOIT
9.3
HIGH · CVSS 2.0 · EPSS 67.9% (pctl 99)
Patch early
A public exploit exists.
Description
Multiple stack-based buffer overflows in the MPEG Layer-3 audio codecs in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allow remote attackers to execute arbitrary code via a crafted AVI file, aka "MPEG Layer-3 Audio Decoder Stack Overflow Vulnerability."
Scoring
| CVSS | 9.3 (HIGH, v2.0) |
|---|---|
| Vector | AV:N/AC:M/Au:N/C:C/I:C/A:C |
| EPSS | 67.89% — more likely to be exploited than 99% of all CVEs |
| Weakness | CWE-119 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2010-04-14 |
| Last modified | 2026-06-16 |
Affected (6)
| Vendor | Product |
|---|---|
| microsoft | windows 2000 |
| microsoft | windows 2003 server |
| microsoft | windows server 2003 |
| microsoft | windows server 2008 |
| microsoft | windows vista |
| microsoft | windows xp |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Microsoft MPEG Layer-3 Audio - Stack Overflow (MS10-026) (Metasploit) | 2011-08-13 |
| exploit-db | Microsoft MPEG Layer-3 Audio Decoder - Division By Zero | 2010-09-24 |
| exploit-db | Microsoft MPEG Layer-3 - Remote Command Execution | 2010-09-05 |
References
- http://securityreason.com/securityalert/8336
- http://www.us-cert.gov/cas/techalerts/TA10-103A.html
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-026
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7441
- http://securityreason.com/securityalert/8336
- http://www.us-cert.gov/cas/techalerts/TA10-103A.html
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-026
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7441
→ the Explorer · watch your stack · NVD