Analyst readout for executives and security teams
Plain-English summary
This is a legacy AOL desktop software flaw in an ActiveX component. If an endpoint still has AOL 9.5-era Phobos.dll installed, a user opening a malicious local HTML file could allow code execution as that user. It is serious for exposed legacy endpoints, but likely uncommon in modern environments.
Executive priority
Prioritize as a legacy endpoint cleanup issue, not a broad internet emergency. Act quickly if regulated, kiosk, shared, or high-risk user systems still carry old AOL components.
Technical view
The vulnerable Phobos.Playlist COM object exposes Import(), which can trigger a stack-based buffer overflow with an overly long string. Sources indicate exploitation is constrained because the control is not marked safe for scripting or initialization, requiring the malicious HTML to be opened locally. Public exploit references exist.
Likely exposure
Most exposure is expected on older Windows endpoints retaining AOL 9.5 or the Phobos.dll ActiveX control. The provided sources do not show AOL Mail or AOL Desktop Gold as affected.
Exploitation context
The source bundle includes public exploit references and third-party detection advisories. It does not indicate CISA KEV listing or verified active exploitation. User interaction and local file opening are required based on the CVSS vector and description.
Researcher notes
The CVE data and references support the buffer overflow and public exploit availability. Product lifecycle and patch status are less complete; the bundle says AOL 9.5 is discontinued and provides no vendor remediation.
Mitigation direction
- Inventory endpoints for legacy AOL 9.5 and Phobos.dll.
- Remove or retire unsupported AOL 9.5-era desktop software.
- Disable or remove the vulnerable ActiveX control where found.
- Block risky local HTML attachment handling through endpoint policy.
- Check vendor guidance; no official patch is named in the provided sources.
- Enable relevant IPS or endpoint detections where available.
Validation and detection
- Confirm whether any endpoint has AOL 9.5-era components installed.
- Check software inventory for Phobos.dll and Phobos.Playlist registration.
- Review email and web controls for local HTML file execution risk.
- Verify Broadcom or FortiGuard signatures are deployed if those products are used.
- Document exceptions for any legacy dependency that cannot be removed.
Public sources used
Based on public source material and reviewed before publication.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-121: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2010-10015 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.4 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——VulnCheckVulnerability scoring details
Base CVSS 4.0 score
8.4HighVector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://web.archive.org/web/20100804162117/http://www.rec-sec.com/2010/01/25/aol-playlist-class-buffer-overflow/CVE reference, VulnCheck · technical-description, exploit
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/aol_phobos_bof.rbCVE reference, VulnCheck · exploit
- https://www.exploit-db.com/exploits/11204CVE reference, VulnCheck · exploit
- https://www.broadcom.com/support/security-center/attacksignatures/detail?asid=26569CVE reference, VulnCheck · third-party-advisory
- https://www.fortiguard.com/encyclopedia/ips/32026/aol-phobos-dll-activex-control-import-buffer-overflowCVE reference, VulnCheck · third-party-advisory
- https://appdb.winehq.org/objectManager.php?sClass=version&iId=20354CVE reference, VulnCheck · product
- http://www.exploit-db.com/exploits/11190CVE reference, VulnCheck · exploit
- https://www.vulncheck.com/advisories/aol-phobos-playlist-import-stack-based-buffer-overflowCVE reference, VulnCheck · third-party-advisory
- https://www.exploit-db.com/exploits/11190CVE reference, CISA-ADP · exploit
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Stack-based Buffer Overflow
Stack-based Buffer Overflow represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.