CVE-2005-0043: Apple iTunes playlist URL buffer overflow allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityRemote code execution with no authentication and a high EPSS score, though exploitation depends on the user opening a malicious playlist.

What it is

Apple iTunes 4.7 contains a buffer overflow triggered by an overly long URL inside .m3u or .pls playlist files. Because playlists are commonly opened from untrusted sources, a crafted file can crash the application or run attacker-supplied code in the context of the user.

Impact

An attacker can execute arbitrary code with the privileges of the user running iTunes, potentially leading to full compromise of the host. The CVSS 2.0 vector rates confidentiality, integrity and availability impact as partial.

Attack surface

The flaw is network-reachable (AV:N) with low complexity and no authentication (AC:L/Au:N), but it requires the victim to open or load a malicious playlist file, so user interaction is effectively needed. No affected version range beyond iTunes 4.7 is stated in the record.

Exploitation

CISA KEV does not list this CVE, but EPSS is high (0.69005, 99.3rd percentile) and one reference is tagged Exploit, indicating public exploit material exists. No ransomware association is documented.

What to do

• Upgrade iTunes to a version later than 4.7 using the Apple security update referenced in the advisory.
• Block or filter .m3u and .pls files arriving via email, web downloads or removable media until patching is complete.
• Configure mail and web gateways to strip or quarantine playlist attachments from untrusted senders.
• Educate users not to open playlist files from unknown or unexpected sources.
• Where possible, run iTunes with least privilege to limit the impact of successful exploitation.

Detection

• Monitor for iTunes crashes or abnormal process terminations when opening .m3u or .pls files.
• Inspect playlist files for unusually long URL fields or embedded shellcode patterns before they are opened.
• Alert on iTunes spawning child processes such as cmd.exe or /bin/sh, which would indicate code execution.
• Review endpoint logs for suspicious file writes or network connections originating from the iTunes process.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.