Loading story…
Three AllokSoft multimedia applications were assigned CVEs for buffer overflow flaws in their License Name registration field that can lead to arbitrary code execution. The affected products are Allok soft WMV to AVI MPEG DVD WMV Converter 4.6.1217 (CVE-2018-25314), Allok AVI to DVD SVCD VCD Converter 4.0.1217 (CVE-2018-25302), and Allok Video to DVD Burner 2.6.1217 (CVE-2018-25303). The vulnerabilities were classified under CWE-120 and CWE-121, with CVSS v3.1 and v4.0 vectors added to the records.
The published descriptions say a local attacker can trigger the flaws by supplying an oversized string in the registration dialog, causing a structured exception handler (SEH) overwrite and execution of embedded shellcode with the application's privileges. One advisory describes exploitation after clicking the Register button, while another notes a payload with junk data, SEH chain pointers, and shellcode pasted into the field. References attached to the CVE records include Exploit-DB, AllokSoft, and VulnCheck advisories, indicating publicly documented exploit details for the affected legacy software.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
A CVE record was received describing a local buffer overflow in the License Name field of Allok soft WMV to AVI MPEG DVD WMV Converter 4.6.1217. According to the entry, an oversized string can trigger an SEH overwrite and enable arbitrary code execution with the application's privileges.
A CVE entry was received for a stack-based buffer overflow in the License Name field of Allok Video to DVD Burner 2.6.1217. The description states that a crafted input can overwrite the SEH chain and execute attacker-supplied shellcode locally.
A CVE record was received documenting a local buffer overflow in the License Name field of Allok AVI to DVD SVCD VCD Converter 4.0.1217. The flaw can be exploited via an SEH overwrite to achieve arbitrary code execution when the Register button is clicked.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity vulnerabilities, **CVE-2019-25629** and **CVE-2019-25631**, affect **AIDA64 5.99.4900** products and can lead to local arbitrary code execution through structured exception handler (**SEH**) buffer overflows. The flaws were reported for **AIDA64 Extreme** and **AIDA64 Business**, respectively, and both are classified as **CWE-787** with a **CVSS v3.1** score vector of `AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, indicating high impact across confidentiality, integrity, and availability. In **CVE-2019-25629**, an attacker can abuse the Hardware Monitoring logging feature in AIDA64 Extreme by supplying a malicious **CSV log file path**, triggering shellcode execution when the application processes that path. In **CVE-2019-25631**, AIDA64 Business is vulnerable through the **SMTP display name** field in preferences or the report wizard, where an attacker can overwrite SEH pointers and use **egg hunter shellcode** to gain code execution. Public references for both issues include vendor pages, **Exploit-DB** listings, and **VulnCheck** advisories.
Jun 29, 2026
Two high-severity vulnerabilities, `CVE-2018-25265` and `CVE-2018-25268`, were documented for **LanSpy 2.0.1.159**, affecting the application's scan functionality and exposing users to local buffer overflow attacks. The flaws were classified as `CWE-787` and can let an attacker trigger memory corruption by supplying oversized input in the scan section or scan field, causing application crashes and creating a path to arbitrary code execution. The published details indicate that `CVE-2018-25265` can be exploited through structured exception handling (SEH), including egghunter-based shellcode discovery and controlled jumps, while `CVE-2018-25268` allows instruction pointer overwrite with a payload consisting of 688 bytes of padding followed by 4 bytes of attacker-controlled data. Both entries were assigned high-impact CVSS v3.1 and CVSS v4.0 severity metrics, and the records reference material from **LizardSystems**, **Exploit-DB**, and **VulnCheck**.
Jun 29, 2026
Two newly recorded CVEs describe **stack-based buffer overflow** flaws that can lead to arbitrary code execution in legacy software components. **CVE-2017-20228** affects **Flat Assembler 1.71.21**, where oversized assembly input exceeding **5895 bytes** can overwrite the instruction pointer and enable **return-oriented programming (ROP)** for shell command execution. The issue is classified as **`CWE-787`** and carries high impact to confidentiality, integrity, and availability. A second entry, **CVE-2018-25222**, affects **SC v7.16** and similarly allows code execution through oversized input, in this case beyond **1052 bytes**, resulting in instruction pointer overwrite and shellcode execution in the application context. The vulnerability is also classified as **`CWE-787`**, with CVSS scoring indicating low attack complexity and severe impact, and both CVEs include references to **Exploit-DB** and **VulnCheck advisories**, signaling the availability of public technical details for defenders to review.
Jun 29, 2026