CVE-2009-0187: Stack-based buffer overflow in Orbit Downloader 2.8.2 and 2.8.3, and possibly other versions before 2.8.5,...

Security readout for executives and security teams

This is a legacy remote code execution flaw in Orbit Downloader. A specially crafted HTTP URL with an overly long host name can trigger a stack-based buffer overflow when the application builds a “Connecting” log message. Business urgency depends on whether old Orbit Downloader versions still exist on managed endpoints. Exposure is likely endpoint-based, not server-side. Systems are relevant only if they still run Orbit Downloader 2.8.2, 2.8.3, or possibly another pre-2.8.5 version. The supplied sources do not identify affected operating systems, deployment prevalence, or enterprise management controls. Treat this as a high-impact legacy software risk. Prioritize rapid confirmation of whether the product exists in the estate. If found, remove or update it because the stated impact is arbitrary code execution from malicious URL handling. Mitigation focus: Inventory endpoints for Orbit Downloader installations and exact versions.; Remove Orbit Downloader if it is no longer required.; Upgrade versions earlier than 2.8.5 where vendor guidance supports that path..

Prepared

Jun 28, 2026, 11:23 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.