CVE-2011-2595: ACDSee FotoSlate PLP File Stack Buffer Overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCVSS 2.0 score of 10 and high EPSS percentile indicate severe impact and likely exploitation activity, though user interaction is required.

What it is

ACDSee FotoSlate 4.0 Build 146 contains multiple stack-based buffer overflows triggered by long id parameters in String or Int tags within a FotoSlate Project (PLP) file. Opening a crafted PLP file can corrupt the stack and allow arbitrary code execution in the context of the user.

Impact

An attacker who gets a victim to open a malicious PLP file can execute arbitrary code with the privileges of the FotoSlate process, potentially leading to full system compromise.

Attack surface

The flaw is reached remotely by supplying a crafted PLP file, typically via email, web download, or shared media. No authentication is required, but successful exploitation depends on the victim opening the file, so user interaction is needed.

Exploitation

The CVE is not listed in CISA KEV and no public exploit references are tagged in the record, though EPSS indicates a high probability of exploitation activity (0.59689, 99th percentile).

What to do

• Apply the vendor patch or upgrade FotoSlate to a version later than 4.0 Build 146 if available.
• Block or restrict opening of untrusted PLP files from email, web, or removable media.
• Run FotoSlate with least privilege and enable OS-level exploit mitigations such as DEP and ASLR.
• Use email and web gateways to strip or quarantine PLP attachments and downloads from untrusted sources.

Detection

• Monitor for FotoSlate process crashes or abnormal child processes spawned after opening PLP files.
• Inspect PLP files for unusually long id values in String or Int tags using file parsing or YARA rules.
• Track endpoint alerts for stack buffer overflow exploitation patterns in the FotoSlate executable.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.