CVE-2018-25304 Overview
CVE-2018-25304 is a local buffer overflow vulnerability in Free Download Manager 2.0 Built 417. The flaw resides in the URL import functionality reached through the File > Import > Import lists of downloads menu. When the application parses a malicious .url file, an oversized Location header response overflows a stack buffer and overwrites the Structured Exception Handler (SEH) chain. An attacker who controls the imported file can hijack execution flow and run arbitrary code in the context of the user running Free Download Manager. The weakness is tracked as a classic buffer copy without size checking [CWE-120].
Critical Impact
Successful exploitation grants arbitrary code execution on the local system through SEH chain overwrite, with full impact to confidentiality, integrity, and availability.
Affected Products
- Free Download Manager 2.0 Built 417
- Legacy installations distributed through third-party mirrors such as FileHippo
- Windows systems running the vulnerable build
Discovery Timeline
- 2026-04-29 - CVE-2018-25304 published to the National Vulnerability Database
- 2026-04-30 - Last updated in NVD database
Technical Details for CVE-2018-25304
Vulnerability Analysis
Free Download Manager 2.0 Built 417 fails to validate the length of data returned in the HTTP Location header when importing a list of URLs. The import routine copies the header value into a fixed-size stack buffer without bounds checking. Overflowing this buffer corrupts adjacent stack memory, including the SEH record used for exception dispatch on Windows. By aligning the overflow so the overwritten SEH handler points to attacker-controlled shellcode, the adversary converts a crash into reliable code execution. The issue maps to [CWE-120], a buffer copy without checking size of input.
Root Cause
The root cause is the absence of input length validation in the URL import parser. The parser trusts the remote server's Location header and writes its contents into a stack buffer using an unsafe copy primitive. Because Free Download Manager 2.0 was built without modern compiler mitigations such as /GS stack cookies and SafeSEH, the overwritten SEH record is dispatched without integrity checks.
Attack Vector
Exploitation requires local user interaction. An attacker crafts a malicious .url file referencing a server they control, then induces the victim to import the file through File > Import > Import lists of downloads. The attacker's server responds with an HTTP redirect containing an oversized Location value. Free Download Manager copies the value into the vulnerable buffer, triggering the overflow. Execution transfers to attacker-supplied shellcode after the next exception is raised. Technical detail and a working proof of concept are documented in Exploit-DB #44499 and the VulnCheck Security Advisory.
Detection Methods for CVE-2018-25304
Indicators of Compromise
- Presence of fdm.exe version 2.0 Built 417 on Windows endpoints.
- Inbound .url or download-list files from untrusted sources opened by Free Download Manager.
- HTTP responses to Free Download Manager containing abnormally long Location header values.
- Unexpected child processes spawned by fdm.exe, such as cmd.exe or powershell.exe.
Detection Strategies
- Inventory endpoints for legacy Free Download Manager installations using software asset management or EDR telemetry.
- Monitor process creation events where fdm.exe is the parent of shell or scripting interpreters.
- Inspect crash dumps and Windows Error Reporting events for access violations inside fdm.exe referencing SEH chain corruption.
Monitoring Recommendations
- Alert on file imports of .url and download-list files arriving via email, browser downloads, or removable media.
- Capture network telemetry for HTTP redirects with Location header lengths exceeding 1024 bytes targeting Free Download Manager user agents.
- Track command-line arguments and module loads for fdm.exe to identify post-exploitation behavior.
How to Mitigate CVE-2018-25304
Immediate Actions Required
- Uninstall Free Download Manager 2.0 Built 417 from all endpoints where it is no longer required.
- Block execution of the vulnerable fdm.exe binary using application control policies such as Windows Defender Application Control or AppLocker.
- Restrict users from importing .url files originating from untrusted sources.
Patch Information
No vendor patch is referenced in the published advisory for Free Download Manager 2.0 Built 417. The product version is legacy and end-of-life. Organizations should migrate to a supported download manager or the current Free Download Manager release line. Consult the VulnCheck Security Advisory and the FileHippo Download Page for version history.
Workarounds
- Avoid using the File > Import > Import lists of downloads feature until the application is removed or replaced.
- Enforce host-based firewall rules that prevent fdm.exe from following redirects to untrusted hosts.
- Enable Data Execution Prevention (DEP) and Exploit Protection mitigations in Windows for fdm.exe to raise the cost of SEH-based exploitation.
# Configuration example: enable Windows Exploit Protection for fdm.exe
Set-ProcessMitigation -Name fdm.exe -Enable DEP,SEHOP,ForceRelocateImages,BottomUp,HighEntropy
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
