Stack-based buffer overflow in mIRC 6.34 allows remote attackers to execute arbitrary code via a long hostname in a PRIVMSG message.

1. 2008-10-02 First public exploit (Metasploit exploit/windows/misc/mirc_privmsg_server)
2. 2008-10-06 Published

38.74% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

• Metasploit exploit/windows/misc/mirc_privmsg_server mIRC PRIVMSG Handling Stack Buffer Overflow metasploit exploit, normal rank, 2008-10-02
• EDB-16422 mIRC 6.34 - PRIVMSG Handling Stack Buffer Overflow (Metasploit) remote, 2010-06-22
• EDB-6666 mIRC 6.34 - Remote Buffer Overflow remote, 2008-10-04
• EDB-6654 mIRC 6.34 - Remote Buffer Overflow (PoC) dos, 2008-10-02
• securityfocus.com http://www.securityfocus.com/bid/31552 referenced PoC, tagged "exploit" by a source, unverified

Weakness

• CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

• exploit-db.com /exploits/6654

  exploit

• exploit-db.com /exploits/6666

  exploit

• securityfocus.com /bid/31552

  vdb-entry, exploit

• secunia.com /advisories/32102

  third-party-advisory, vendor-advisory

• exchange.xforce.ibmcloud.com /vulnerabilities/45624

  vdb-entry

• securityreason.com /securityalert/4352

  third-party-advisory

• vupen.com /english/advisories/2008/2736

  vdb-entry

• CVE List CVE-2008-4449
• NVD CVE-2008-4449

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.