Seh-Overwrite — CraftedSignal Threat Feed

Free Download Manager 2.0 Built 417 Local Buffer Overflow Vulnerability

hello@craftedsignal.io — Wed, 29 Apr 2026 20:16:25 +0000

Free Download Manager (FDM) version 2.0 Built 417 is susceptible to a local buffer overflow vulnerability (CVE-2018-25304) within its URL import functionality. This vulnerability, discovered and reported by VulnCheck, allows an attacker to craft a malicious URL file. When a user imports this specially crafted file through the “File > Import > Import lists of downloads” menu, the application attempts to process the ‘Location’ header response, triggering a buffer overflow. This overflow overwrites the Structured Exception Handler (SEH) chain, enabling the attacker to execute arbitrary code within the context of the FDM process. This vulnerability can be exploited locally by tricking a user into importing a malicious file.

Attack Chain

Attacker crafts a malicious .url file containing an overly long Location header value designed to cause a buffer overflow.
The victim is convinced to download the malicious .url file (e.g., through social engineering).
The victim opens Free Download Manager 2.0 Built 417.
The victim navigates to “File > Import > Import lists of downloads” within FDM.
The victim selects the downloaded malicious .url file and initiates the import process.
FDM parses the malicious .url file and attempts to process the long Location header.
The excessively long Location header causes a buffer overflow, overwriting the SEH chain.
When an exception is triggered (due to the overflow), the overwritten SEH chain is used to redirect execution to attacker-controlled code, resulting in arbitrary code execution.

Impact

Successful exploitation of this buffer overflow vulnerability allows an attacker to execute arbitrary code on the victim’s system with the privileges of the Free Download Manager process. This could lead to complete system compromise, data theft, or installation of malware. While specific victim counts are unavailable, the vulnerability poses a significant risk to users of Free Download Manager 2.0 Built 417.

Recommendation

Monitor for process creation events originating from Free Download Manager after importing a .url file to detect potential exploitation attempts (see Sigma rule “Detect Free Download Manager Suspicious Process Creation After Import”).
Implement file integrity monitoring (FIM) on the Free Download Manager executable directory to detect unauthorized modifications potentially related to exploitation.
Consider using application control solutions to restrict the execution of unsigned or untrusted code within the Free Download Manager process.

Allok Video to DVD Burner Stack-Based Buffer Overflow Vulnerability (CVE-2018-25303)

hello@craftedsignal.io — Wed, 29 Apr 2026 20:16:25 +0000

A stack-based buffer overflow vulnerability exists in Allok Video to DVD Burner version 2.6.1217. This vulnerability, identified as CVE-2018-25303, resides within the “License Name” field of the application. A local attacker can exploit this flaw by crafting a malicious input designed to overwrite the Structured Exception Handler (SEH). Successful exploitation enables the attacker to execute arbitrary code within the context of the application. The vulnerability was reported on 2026-04-29. This is important for defenders because successful exploitation can lead to complete system compromise on vulnerable machines.

Attack Chain

The attacker gains local access to a system with Allok Video to DVD Burner 2.6.1217 installed.
The attacker crafts a malicious input string consisting of 780 bytes of arbitrary data.
The attacker appends SEH chain pointers and shellcode to the crafted input string.
The attacker opens the Allok Video to DVD Burner application and navigates to the registration window.
The attacker pastes the malicious input string into the “License Name” field.
The application attempts to process the oversized input, triggering the buffer overflow.
The SEH is overwritten with the attacker’s controlled pointers.
The shellcode is executed, giving the attacker arbitrary code execution on the system.

Impact

Successful exploitation of this vulnerability allows a local attacker to execute arbitrary code within the context of the Allok Video to DVD Burner application. This could lead to complete system compromise, including data theft, installation of malware, or other malicious activities. The vulnerability affects version 2.6.1217 of the software. The number of potential victims depends on the number of installations of the vulnerable software.

Recommendation

Monitor process creations for Allok Video to DVD Burner and unusual child processes using the process creation rule below.
Monitor for registry modifications performed by the vulnerable application that may indicate persistence.
Due to the age of the application, consider whether it should continue to be used within the environment.

R i386 3.5.0 Local Buffer Overflow Vulnerability (CVE-2019-25656)

hello@craftedsignal.io — Sun, 05 Apr 2026 21:16:42 +0000

R i386 version 3.5.0 contains a local buffer overflow vulnerability, identified as CVE-2019-25656, within the GUI Preferences dialog. This vulnerability allows a local attacker to achieve arbitrary code execution by exploiting a buffer overflow when the application processes user-supplied input in the ‘Language for menus and messages’ field. By crafting a malicious payload string, an attacker can overwrite the Structured Exception Handler (SEH) records. Successful exploitation would allow attackers to execute arbitrary code with the privileges of the user running the application. This poses a significant risk to systems running this vulnerable version of R, potentially leading to complete system compromise.

Attack Chain

Attacker gains local access to a Windows system running R i386 3.5.0.
Attacker opens the R application.
Attacker navigates to the GUI Preferences dialog within the R application.
Attacker identifies the ‘Language for menus and messages’ field within the GUI Preferences.
Attacker crafts a malicious payload string designed to overwrite SEH records, including shellcode for arbitrary code execution.
Attacker inputs the malicious string into the ‘Language for menus and messages’ field.
The R application attempts to process the attacker-supplied string without proper bounds checking, triggering the buffer overflow.
The crafted payload overwrites the SEH record, redirecting execution flow to the attacker-controlled shellcode, resulting in arbitrary code execution.

Impact

Successful exploitation of this vulnerability allows a local attacker to execute arbitrary code on the targeted system. The impact includes potential privilege escalation, allowing the attacker to perform actions with the same privileges as the user running the R application. This could lead to the installation of malware, data exfiltration, or complete system compromise. While specific victim numbers are not available, any system running the vulnerable R i386 3.5.0 is at risk.

Recommendation

Upgrade R to a version higher than 3.5.0 to patch CVE-2019-25656.
Deploy the Sigma rule to detect the execution of R with a modified command line containing long strings to identify potential exploit attempts.
Monitor network connections originating from R processes for suspicious outbound traffic using network connection logs.
Implement the Sigma rule to detect abnormal process execution originating from the R application to catch potential exploitation attempts.

Base64 Decoder 1.1.2 Stack-Based Buffer Overflow (CVE-2019-25634)

hello@craftedsignal.io — Tue, 24 Mar 2026 12:16:04 +0000

Base64 Decoder version 1.1.2 is susceptible to a stack-based buffer overflow vulnerability, identified as CVE-2019-25634. This flaw enables a local attacker to execute arbitrary code on a vulnerable system. The vulnerability arises from insufficient bounds checking when processing input, allowing an attacker to overwrite critical parts of the stack. Successful exploitation requires the attacker to craft a malicious input file specifically designed to trigger the overflow. The impact of this…

DVDXPlayer Pro 5.5 Local Buffer Overflow Vulnerability (CVE-2019-25604)

hello@craftedsignal.io — Mon, 23 Mar 2026 12:00:00 +0000

DVDXPlayer Pro 5.5 is susceptible to a local buffer overflow vulnerability (CVE-2019-25604) that can be exploited by local attackers. This vulnerability allows for arbitrary code execution through the creation of specially crafted playlist files (.plf). The attack involves overflowing a buffer and hijacking the Structured Exception Handling (SEH) chain to execute attacker-controlled code within the context of the application. The vulnerability was reported in March 2026. Successful exploitation…