CVE-2009-2485: HT-MP3Player .ht3 file stack buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityPublic exploit code exists and the flaw allows remote code execution, but the product is old and the record lacks patch and vendor details.

What it is

HT-MP3Player 1.0 contains a stack-based buffer overflow (CWE-119) triggered by a long string in a .ht3 file. Opening a crafted file can overwrite stack memory and allow arbitrary code execution. The flaw is remotely reachable because the malicious file can be delivered to the victim.

Impact

An attacker who gets a victim to open a crafted .ht3 file can execute arbitrary code in the context of the player process. The CVSS 2.0 vector rates full confidentiality, integrity and availability impact.

Attack surface

Reached by supplying a malicious .ht3 file to the application; the CVSS vector AV:N/AC:M/Au:N indicates network delivery with no authentication, but medium complexity and likely user interaction to open the file.

Exploitation

No CISA KEV listing and no ransomware association. EPSS is 0.58099 (99th percentile), and the only references are two duplicate Exploit-DB entries, indicating public exploit code exists.

What to do

• Upgrade or replace HT-MP3Player 1.0; no fixed version is identified in this record, so treat the product as unsupported if no patch exists.
• Block or strip .ht3 files at email and web gateways until the player is removed or patched.
• Remove HT-MP3Player from endpoints where it is not required, or restrict its file associations.
• Warn users not to open .ht3 files from untrusted sources.

Detection

• Monitor for HT-MP3Player process crashes or abnormal child processes spawned from the player.
• Scan email and web proxy logs for .ht3 file transfers.
• Hunt for .ht3 files on endpoints and inspect them for oversized strings.
• Alert on Exploit-DB 9034 signatures or related payload patterns in network or host telemetry.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.