CVE-2019-25571CWE-226

CVE-2019-25571

Medium · published March 21, 2026

CVSS v3.1
6.2
EPSS
0%
Percentile
7.3
In the wild
Unconfirmed
What it is

MediaMonkey 4.1.23 contains a denial of service vulnerability that allows local attackers to crash the application by opening a specially crafted MP3 file containing an excessively long URL string. Attackers can create a malicious MP3 file with a buffer containing 4000 bytes of data appended to a URL, which causes the application to crash when the file is opened through the File > Open URL dialog.

The record
Technical detail
CVSS v3.1
6.2 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00181 · 7.3th percentile
Weakness
CWE-226 · Sensitive Information in Resource Not Removed Before Reuse
Published
2026-03-21T17:16Z
Affected products (1)
ProductVersionsFixed in
ventismedia/mediamonkeyall versions—
References (4)
https://www.exploit-db.com/exploits/46378 · [email protected]https://www.mediamonkey.com/ · [email protected]https://www.mediamonkey.com/sw/MediaMonkey_4.1.23.1881.exe · [email protected]https://www.vulncheck.com/advisories/mediamonkey-denial-of-service-via-malformed-url · [email protected]
EPSS history
Timeline
  • 21 MAR 12:47Z
    MediaMonkey 4.1.23 Denial of Service via Malformed URL
    cvelistv5