DNS
CVE-2019-25318
HIGH
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 8.8 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: None. User interaction: Required. Public exploit/POC available. |
| Exploit ScenarioDerived | An attacker could exploit this vulnerability to execute arbitrary code by manipulating the output folder text input. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
AVS Audio Converter 9.1.2.600 contains a stack overflow vulnerability that allows attackers to execute arbitrary code by manipulating the output folder text input. [CVSS 8.8 HIGH]
RemediationAI
Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.
Affected ProductsAI
AVS Audio Converter 9.1.2.600 contains a stack overflow vulnerability that allows attackers to execute arbitrary code by manipulating the output folde
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Classified as CWE-121 (Stack-based Buffer Overflow). AVS Audio Converter 9.1.2.600 contains a stack overflow vulnerability that allows attackers to execute arbitrary code by manipulating the output folder text input. Attackers can craft a malicious payload that overwrites stack memory and triggers a bind shell on port 9999 when the 'Browse' button is clicked.
Know when DNS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
AVS Audio Converter 9.1.2.600 contains a stack overflow vulnerability that allows attackers to execute arbitrary code by manipulating the output folder text input. Attackers can craft a malicious payload that overwrites stack memory and triggers a bind shell on port 9999 when the 'Browse' button is clicked.
Executive ViewAI
AVS Audio Converter 9.1.2.600 contains a critical stack overflow vulnerability (CVE-2019-25318) that enables arbitrary code execution if users process untrusted files or interact with malicious folder paths. Any organization deploying this software faces immediate risk of compromise, particularly if the application processes user-supplied or external audio content.
Disable or uninstall AVS Audio Converter 9.1.2.600 immediately. If removal is not feasible: restrict application execution via application whitelisting/AppLocker policies; prevent end-user access to untrusted audio files; isolate affected systems from critical infrastructure using network segmentation; disable folder/file input dialogs where possible; monitor process execution logs for suspicious AVS behavior; consider containerization or sandbox execution to limit blast radius if exploitation occurs.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Exploit-DB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Sandbox escape in Kata Containers allowing guest VM to access host resources. CVSS 10.0 — undermines the core security g
Buffer overflow in Ayukov NFTP client 1.71 in SYST command handling allows remote FTP servers to execute arbitrary code
Buffer overflow in Prime95 29.8 build 6 user ID field allows code execution. PoC available.
Stack overflow in Domain Quester Pro 6.02 via SEH overwrite. PoC available.
Cyberoam Authentication Client 2.1.2.7 has a buffer overflow allowing remote attackers to execute code through the netwo
Kingdia CD Extractor 3.0.2 has a buffer overflow in the registration name field. PoC available.
Ether MP3 CD Burner 1.3.8 has buffer overflow in registration enabling bind shell on port 3110 via SEH overwrite. PoC av
Buffer overflow in WMV to AVI MPEG DVD Convertor 4.6.1217 allows code execution via crafted media files. PoC available.
Stack-based buffer overflow in Nsauditor Network Auditing Tool 3.0.28 and 3.2.1.0 in the DNS Lookup tool allows attacker
Stack-based buffer overflow in Tenda RX3 firmware 16.03.13.11 allows authenticated remote attackers to achieve full syst
Remote code execution in Tenda F453 1.0.0.3 DNS firmware via a buffer overflow in the /goform/SetIpBind endpoint allows
Remote code execution in Tenda A21 1.0.0.0 firmware results from a stack buffer overflow in the SetIpMacBind function ac
GitHub PoC