CVE-2011-10024 Details
Description
MJM Core Player (likely now referred to as MJM Player) 2011 is vulnerable to a stack-based buffer overflow when parsing specially crafted .s3m music files. The vulnerability arises from improper bounds checking in the file parser, allowing an attacker to overwrite memory on the stack and execute arbitrary code. Exploitation is triggered when a user opens a malicious .s3m file, and the exploit bypasses DEP and ASLR protections using a ROP chain.
A stack-based buffer overflow vulnerability has been identified in MJM Core Player 2011, specifically in the file version 2.4. The issue arises from inadequate bounds checking when the player parses .s3m music files. This flaw allows attackers to overwrite memory on the stack, potentially leading to arbitrary code execution. The vulnerability can be exploited by opening a malicious .s3m file, with the exploit bypassing Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) protections using a Return-Oriented Programming (ROP) chain.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 20, 2025CISA-ADP
Assessed Aug 22, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-121 | Stack-based Buffer Overflow | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| MJM Core Player | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 16, 2026 | CVE Modified | [email protected] |
| Jun 16, 2026 | CVE Modified | CISA-ADP |
| Aug 22, 2025 | CVE Modified | CISA-ADP |
| Aug 20, 2025 | New CVE Received | [email protected] |