CVE-2010-10015
AOL <= 9.5 Phobos.Playlist 'Import()' Stack-Based Buffer Overflow
- Published
- Updated
- Reserved
- Assigned by
- VulnCheck
Description
AOL versions up to and including 9.5 includes an ActiveX control (Phobos.dll) that exposes a method called Import() via the Phobos.Playlist COM object. This method is vulnerable to a stack-based buffer overflow when provided with an excessively long string argument. Exploitation allows remote attackers to execute arbitrary code in the context of the user, but only when the malicious HTML file is opened locally, due to the control not being marked safe for scripting or initialization. AOL remains an active and supported brand offering services like AOL Mail and AOL Desktop Gold, but the legacy AOL 9.5 desktop software—specifically the version containing the vulnerable Phobos.dll ActiveX control—is long discontinued and no longer maintained.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| VulnCheckCNA (assigner) | 4.0 | High8.4 | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| NVDNVD · Deferred | 4.0 | High8.4 | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
- EPSS (exploitation in 30 days)
- 0.60% · top 51% of all CVEs (5 Nov 2026)
- CISA SSVC
- Exploitation: poc · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.4.
Weakness
Affected products
References (9)
- https://web.archive.org/web/20100804162117/http://www.rec-sec.com/2010/01/25/aol-playlist-class-buffer-overflow/ (opens in a new tab)technical-descriptionexploit
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/aol_phobos_bof.rb (opens in a new tab)exploit
- https://www.exploit-db.com/exploits/11204 (opens in a new tab)exploit
- https://www.broadcom.com/support/security-center/attacksignatures/detail?asid=26569 (opens in a new tab)third-party-advisory
- https://www.fortiguard.com/encyclopedia/ips/32026/aol-phobos-dll-activex-control-import-buffer-overflow (opens in a new tab)third-party-advisory
- https://appdb.winehq.org/objectManager.php?sClass=version&iId=20354 (opens in a new tab)product
- http://www.exploit-db.com/exploits/11190 (opens in a new tab)exploit
- https://www.vulncheck.com/advisories/aol-phobos-playlist-import-stack-based-buffer-overflow (opens in a new tab)third-party-advisory
- https://www.exploit-db.com/exploits/11190 (opens in a new tab)exploit
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2010-10015)Record last updated .