CVE-2018-25304 PUBLISHED

Free Download Manager 2.0 Built 417 Local Buffer Overflow SEH

Assigner: VulnCheck
Reserved: 29.04.2026 Published: 29.04.2026 Updated: 29.04.2026

Free Download Manager 2.0 Built 417 contains a local buffer overflow vulnerability in the URL import functionality that allows attackers to trigger a structured exception handler (SEH) chain exploitation. Attackers can craft a malicious URL file that, when imported through the File > Import > Import lists of downloads menu, causes a buffer overflow in the Location header response that overwrites the SEH chain and executes arbitrary code.

Metrics

CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS Score: 8.6

Product Status

Vendor Filehippo
Product Free Download Manager
Versions
  • Version 2.0 is affected

Credits

  • Marwan Shamel finder

References

Problem Types

  • Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE