CVE-2010-10015

UNKNOWN 0.0

AOL <= 9.5 Phobos.Playlist 'Import()' Stack-Based Buffer Overflow

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

AOL versions up to and including 9.5 includes an ActiveX control (Phobos.dll) that exposes a method called Import() via the Phobos.Playlist COM object. This method is vulnerable to a stack-based buffer overflow when provided with an excessively long string argument. Exploitation allows remote attackers to execute arbitrary code in the context of the user, but only when the malicious HTML file is opened locally, due to the control not being marked safe for scripting or initialization. AOL remains an active and supported brand offering services like AOL Mail and AOL Desktop Gold, but the legacy AOL 9.5 desktop software—specifically the version containing the vulnerable Phobos.dll ActiveX control—is long discontinued and no longer maintained.

CWE	CWE-121
Vendor	aol
Product	aol
Published	Aug 21, 2025
Last Updated	Apr 7, 2026

Stay Ahead of the Next One

Get instant alerts for aol aol

Be the first to know when new unknown vulnerabilities affecting aol aol are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

AOL / AOL

* ≤ 9.5 (Revision 4337.155)

References

NVD ↗ CVE.org ↗ EPSS Data ↗

web.archive.org: https://web.archive.org/web/20100804162117/http://www.rec-sec.com/2010/01/25/aol-playlist-class-buffer-overflow/ raw.githubusercontent.com: https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/aol_phobos_bof.rb exploit-db.com: https://www.exploit-db.com/exploits/11204 broadcom.com: https://www.broadcom.com/support/security-center/attacksignatures/detail?asid=26569 fortiguard.com: https://www.fortiguard.com/encyclopedia/ips/32026/aol-phobos-dll-activex-control-import-buffer-overflow appdb.winehq.org: https://appdb.winehq.org/objectManager.php?sClass=version&iId=20354 exploit-db.com: http://www.exploit-db.com/exploits/11190 vulncheck.com: https://www.vulncheck.com/advisories/aol-phobos-playlist-import-stack-based-buffer-overflow exploit-db.com: https://www.exploit-db.com/exploits/11190

Credits

Hellcode Research