CVE-2026-51105

Stack‑Based Buffer Overflow in aMule's OP_SERVERMESSAGE Causes Remote Denial of Service

View on CVE.org
Published Jul 14, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Description
Buffer Overflow vulnerability in aMULE-Project aMule v.2.3.3 allows a remote attacker to cause a denial of service via the OP_SERVERMESSAGE Handler.

Analysis

AI-generated

Technical impact

This vulnerability is a stack‑based buffer overflow in the OP_SERVERMESSAGE handler of aMule 2.3.3. A remote attacker can send a specially crafted message that overflows a buffer on the server side, causing the aMule process to crash and leading to a denial of service. The flaw is identified as CWE-121 and carries a CVSS score of 7.5, indicating moderate to high severity.

Affected Systems

aMule – the peer‑to‑peer file sharing application – version 2.3.3 is affected. No other vendor or product versions are listed in the CNA data.

Risk and Exploitability

The EPSS score of less than 1% suggests exploitation is currently rare, and the vulnerability is not listed in CISA’s KEV catalog. However, because the flaw can be triggered remotely by an attacker who can send a malicious OP_SERVERMESSAGE, the risk remains for systems exposed to untrusted peers. An attacker would need to send a crafted message to the aMule server; no additional compromises are required. The impact is a crash of the aMule service, causing a service interruption in the network using it.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade aMule to a version that contains the buffer overflow fix, such as version 2.3.4 or later.
  • If an upgrade cannot be performed immediately, place the aMule service behind a firewall that only allows inbound connections from trusted network hosts or block the OP_SERVERMESSAGE handler at the network level to reduce exposure.
  • Monitor system logs for segmentation faults or repeated crashes and apply runtime memory protection measures or input validation if possible.

Generated by OpenCVE AI on July 31, 2026 at 10:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Title Stack‑Based Buffer Overflow in aMule's OP_SERVERMESSAGE Causes Remote Denial of Service
Type Values Removed Values Added
Title Remote Buffer Overflow in aMule 2.3.3 Causes Denial of Service
Type Values Removed Values Added
Title Remote Buffer Overflow in aMule 2.3.3 Causes Denial of Service
Type Values Removed Values Added
Title Remote Buffer Overflow in OP_SERVERMESSAGE Handler of aMule 2.3.3 Leading to Denial of Service
Type Values Removed Values Added
Title Remote Buffer Overflow in OP_SERVERMESSAGE Handler of aMule 2.3.3 Leading to Denial of Service
Type Values Removed Values Added
Weaknesses CWE-121
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Buffer Overflow vulnerability in aMULE-Project aMule v.2.3.3 allows a remote attacker to cause a denial of service via the OP_SERVERMESSAGE Handler.
References
Earlier changes (2)

Subscriptions

No data.

Weaknesses
  • CWE-121

    Stack-based Buffer Overflow

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Jul 14, 2026, 3:21 PM
Reserved
Jun 7, 2026, 12:00 AM

View source JSON

Updated
Jul 14, 2026, 3:21 PM

JSON

Status
Deferred
Published
Jul 14, 2026, 3:17 PM
Modified
Oct 24, 2026, 9:10 PM

View source JSON

No data.

Updated
Jul 31, 2026, 11:00 AM

JSON