CVE-2008-1602: Orbit Downloader URL Handling Stack Buffer Overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCVSS 10.0 with public exploit code and very high EPSS, though the product is old and no longer widely deployed.

What it is

Orbit Downloader 2.6.3 and 2.6.4 contain a stack-based buffer overflow in the handling of a long download URL. The overflow occurs during Unicode conversion for a balloon notification after a download fails, allowing remote code execution.

Impact

A remote attacker can execute arbitrary code in the context of the user running Orbit Downloader. Successful exploitation gives full control of the affected process and potentially the host.

Attack surface

Reachable over the network via a crafted long download URL; no authentication is required. Some user interaction is implied because a download must be initiated and then fail to trigger the vulnerable notification path.

Exploitation

No CISA KEV listing, but EPSS is 0.6749 (99.27th percentile) and a reference is tagged Exploit, indicating public exploit code exists.

What to do

• Upgrade Orbit Downloader to a version later than 2.6.4, or remove the product if no fixed version is available.
• Block or filter unusually long URLs at the network perimeter and in download clients.
• Restrict user ability to install and run unmanaged download managers on endpoints.
• Apply the vendor patch referenced in the Core Security and SecurityFocus advisories.

Detection

• Monitor for crashes or abnormal process termination in Orbit Downloader.
• Inspect network traffic for excessively long download URLs directed at hosts running Orbit Downloader.
• Review endpoint logs for Orbit Downloader spawning unexpected child processes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.