Internet Download Manager 6.38.12 contains a buffer overflow in the Scheduler component that can be triggered by supplying a malformed string longer than 5,000 bytes in the "Open the following file when done" field. The overflow corrupts the stack and causes the application to crash, resulting in a denial of service for the user who launched the download. The vulnerability is a classic buffer‑copy without bounds checking flaw (CWE‑120).

The affected software is Internet Download Manager version 6.38.12, distributed by the vendor Internetdownloadmanager.

The CVSS score of 6.9 indicates a moderate severity for a local denial of service. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the exploit requires local access to the machine and manipulation of the Scheduler input, it is unlikely to be leveraged remotely unless a remote code execution vulnerability is also present. Nonetheless, any local attacker who can launch the application has a straightforward path to cause a crash.