Security readout for executives and security teams
Plain-English summary
WM Downloader 3.1.2.2 can be compromised if a user opens a malicious M3U playlist file. Successful exploitation can run attacker code as that user. This is serious for any environment still running the legacy application, but it requires user interaction and the sources do not show confirmed active exploitation.
Executive priority
Treat as high priority only where WM Downloader is present. The business risk is endpoint compromise through user-opened files, with public exploit material available. If the software is absent, residual risk is low.
Technical view
The issue is a local file-processing buffer overflow in WM Downloader 3.1.2.2. A malformed .m3u file can overwrite SEH records and enable arbitrary code execution with current-user privileges. The bundle maps CWE-120 and CWE-134 and lists CVSS 4.0 score 8.4. Public exploit references exist.
Likely exposure
Exposure is most likely limited to legacy Windows endpoints where WM Downloader 3.1.2.2 is installed or associated with playlist files. The affected data in the bundle is internally inconsistent, listing version 0 while the description names 3.1.2.2, so confirm locally.
Exploitation context
Exploitation is local and user-assisted: a target must open a malicious playlist file. KEV is false in the provided bundle, so active exploitation should not be claimed. Public exploit entries and a Metasploit module increase validation and abuse potential.
Researcher notes
Evidence supports a file-format memory corruption flaw with SEH overwrite behavior. Do not infer remote network exploitation. The affected-version metadata conflicts with the narrative, and the sources provided do not name a patch. Validate product presence before escalation.
Mitigation direction
- Identify and remove WM Downloader if it is not business-required.
- If required, check vendor or trusted advisory guidance for fixed versions or replacements.
- Block or quarantine unsolicited M3U playlist files at email and web gateways.
- Remove WM Downloader file associations for playlist formats where feasible.
- Use endpoint controls to restrict untrusted file execution paths.
Validation and detection
- Inventory endpoints for WM Downloader, especially version 3.1.2.2.
- Confirm whether .m3u files open with WM Downloader by default.
- Review email, web, and EDR logs for suspicious M3U file handling.
- Check IPS coverage for the FortiGuard WM Downloader buffer overflow signature.
- Record compensating controls if no vendor patch is available.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-120: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-134: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2010-10017 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.4 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——VulnCheckVulnerability scoring details
Base CVSS 4.0 score
8.4HighVector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/wm_downloader_m3u.rbCVE reference, VulnCheck · exploit
- https://www.exploit-db.com/exploits/14497CVE reference, VulnCheck · exploit
- https://www.exploit-db.com/exploits/16642CVE reference, VulnCheck · exploit
- https://www.fortiguard.com/encyclopedia/ips/24038/wm-downloader-buffer-overflowCVE reference, VulnCheck · third-party-advisory
- https://www.vulncheck.com/advisories/wm-downloader-buffer-overflow-via-malformed-m3u-fileCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Use of Externally-Controlled Format String
Use of Externally-Controlled Format String represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.