CVE-2006-2910

Medium

Published: 05/07/2006(UTC)Updated: 23/09/2026(UTC)Translated: 23/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

2.12%

81th percentile - higher than 81% of all known CVEs

Summary

Buffer overflow in jetAudio 6.2.6.8330 (Basic), and possibly other versions, allows user-assisted attackers to execute arbitrary code via an audio file (such as WMA) with long ID Tag values including Title, Author, and Album. The overflow triggers in the tooltip display string if the sound card driver is disabled or incorrectly installed.

Risk Assessment

An attacker can trick a user into opening a crafted audio file, potentially leading to arbitrary code execution in the user's context. The risk is high as it only requires user interaction.

Recommendation

Update jetAudio to the latest version that fixes this vulnerability. Avoid opening audio files from untrusted sources.

Other vulnerabilities in jetAudio

CVE-2019-25595Medium
Vulnerability in jetAudio 8.1.7.20702 Basic allows local attackers to crash the application by supplying an excessively long string through the URL input handler. Attackers can trigger the crash by pasting a buffer of 5000 characters into the Open URL dialog, causing the application to terminate abnormally.

Original NVD description (English source)

Buffer overflow in jetAudio 6.2.6.8330 (Basic), and possibly other versions, allows user-assisted attackers to execute arbitrary code via an audio file (such as WMA) with long ID Tag values including (1) Title, (2) Author, and (3) Album, which triggers the overflow in the tooltip display string if the sound card driver is disabled or incorrectly installed.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS