Stack-based buffer overflow in MultiMedia Soft AdjMmsEng.dll 7.11.1.0 and 7.11.2.7, as distributed in multiple MultiMedia Soft audio compon…

1. 2009-02-03 First public exploit (EDB-7958)
2. 2009-02-08 Published

37.04% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

• Metasploit exploit/windows/fileformat/audiotran_pls_1424 Audiotran PLS File Stack Buffer Overflow metasploit exploit, good rank, 2010-09-09
• Metasploit exploit/windows/fileformat/audiotran_pls Audiotran 1.4.1 (PLS File) Stack Buffer Overflow metasploit exploit, good rank, 2010-01-09
• Metasploit exploit/windows/fileformat/audio_wkstn_pls Audio Workstation 6.4.2.4.3 pls Buffer Overflow metasploit exploit, good rank, 2009-12-08
• EDB-16626 Audiotran 1.4.1 - '.pls' Local Stack Buffer Overflow (Metasploit) local, 2010-01-28
• EDB-15013 MP3 Workstation 9.2.1.1.2 - Local Overflow (SEH) local, 2010-09-15
• EDB-11079 Audiotran 1.4.1 (Windows XP SP2/SP3 English) - Local Buffer Overflow local, 2010-01-10
• EDB-10353 Audio Workstation - '.pls' Local Buffer Overflow (SEH) local, 2009-09-24
• EDB-7974 Euphonics Audio Player 1.0 (Windows XP SP3) - '.pls' Local Buffer Overflow local, 2009-02-04
• EDB-7973 Euphonics Audio Player 1.0 - '.pls' Universal Local Buffer Overflow local, 2009-02-04
• EDB-7958 Euphonics Audio Player 1.0 - '.pls' Local Buffer Overflow local, 2009-02-03

Weakness

• CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

• exploit-db.com /exploits/7958

  exploit

• exploit-db.com /exploits/7973

  exploit

• exploit-db.com /exploits/7974

  exploit

• secunia.com /advisories/33817

  third-party-advisory, vendor-advisory

• secunia.com /advisories/33791

  third-party-advisory, vendor-advisory

• securityfocus.com /archive/1/500652/100/0/threaded

  mailing-list

• securityfocus.com /bid/33589

  vdb-entry

• vupen.com /english/advisories/2009/0316

  vdb-entry

• CVE List CVE-2009-0476
• NVD CVE-2009-0476

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.