CVE-2019-25474: Easy MP3 Downloader DoS Vulnerability

CVE-2019-25474 Overview

CVE-2019-25474 is a buffer overflow vulnerability in Easy MP3 Downloader version 4.7.8.8. The flaw resides in the application's handling of input submitted to the Unlock Code field during startup. A local attacker who supplies an excessively long string, such as 6000 A characters, can overflow the fixed-size input buffer and crash the application. The issue is classified as an out-of-bounds write [CWE-787] and results in a denial of service condition against the affected process. Exploitation requires local access to the host where the application is launched, and no authentication is required to trigger the crash.

Critical Impact
A local attacker can reliably crash Easy MP3 Downloader 4.7.8.8 by pasting a 6000-character payload into the Unlock Code field, producing a denial of service against the application.

Affected Products

Easy MP3 Downloader 4.7.8.8
Windows desktop installations of the affected build
Legacy versions distributed through third-party download portals

Discovery Timeline

2026-03-11 - CVE-2019-25474 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2019-25474

Vulnerability Analysis

The vulnerability is a classic stack-based buffer overflow triggered through user-controlled input. Easy MP3 Downloader 4.7.8.8 displays an Unlock Code dialog when the application starts. The input handler copies the supplied string into a fixed-size buffer without validating its length. When the attacker supplies roughly 6000 bytes, the copy operation writes beyond the allocated buffer and corrupts adjacent stack memory. The corruption causes the process to terminate, producing a denial of service. The issue is local in scope because the attacker must interact with the running application's UI. The public proof of concept demonstrates only crash behavior, and no code execution primitive has been published.

Root Cause

The root cause is missing length validation on input read from the Unlock Code field. The application uses an unbounded string copy into a fixed-size stack buffer, matching the [CWE-787] out-of-bounds write pattern. No canary, bounds check, or input truncation guards the destination buffer.

Attack Vector

The attack vector is local. An attacker prepares a text file containing 6000 A characters, opens Easy MP3 Downloader 4.7.8.8, and pastes the contents into the Unlock Code field at startup. Submitting the value triggers the overflow and crashes the application. The vulnerability is described in detail in the Exploit-DB #47319 entry and the VulnCheck Advisory: Easy MP3 Downloader.

Detection Methods for CVE-2019-25474

Indicators of Compromise

Unexpected termination of the Easy MP3 Downloader process shortly after launch
Windows Application Error events referencing the Easy MP3 Downloader executable with exception code 0xC0000005
Presence of text files containing long repeating character sequences in user download or clipboard staging directories

Detection Strategies

Monitor process crash telemetry for Easy MP3 Downloader binaries and correlate with recent clipboard or file paste activity
Inspect Windows Error Reporting (WER) artifacts for crash dumps tied to the application's startup dialog
Flag installations of Easy MP3 Downloader 4.7.8.8 through software inventory queries against endpoint asset data

Monitoring Recommendations

Track Event ID 1000 (Application Error) and Event ID 1001 (Windows Error Reporting) entries naming the affected executable
Alert on creation of files containing long single-character runs that match the public proof-of-concept pattern
Audit endpoints for unsupported or end-of-life multimedia downloader software

How to Mitigate CVE-2019-25474

Immediate Actions Required

Uninstall Easy MP3 Downloader 4.7.8.8 from all managed endpoints, as the product is unmaintained
Block execution of the application binary using application control or software restriction policies
Restrict local user accounts that interact with untrusted multimedia tools to limit exposure

Patch Information

No vendor patch is referenced in the NVD entry or the VulnCheck Advisory: Easy MP3 Downloader. The product appears to be abandoned, and the CNET Software Information listing does not reflect any updated build addressing this issue. Organizations should treat removal as the only reliable remediation.

Workarounds

Replace Easy MP3 Downloader with an actively maintained media download utility from a trusted vendor
Prevent users from pasting clipboard content into the Unlock Code field at application startup
Enforce least privilege so the affected application cannot be installed without administrative approval

bash

# Configuration example: block the executable using Windows AppLocker PowerShell
New-AppLockerPolicy -RuleType Path -User Everyone -Action Deny \
  -Path "%PROGRAMFILES%\Easy MP3 Downloader\EasyMP3Downloader.exe" \
  -RuleNamePrefix "Block-CVE-2019-25474"