aria2 up to version 1.37.0 contains a stack‑buffer‑underflow flaw in the IOFile::getLine() function. The flaw occurs when the function processes a line that causes a write below the start of the stack buffer, corrupting adjacent memory. This corruption can lead to a program crash or, if an attacker can tailor the input, a denial of service or memory‑related exploit. The description does not explicitly state remote code execution, but stack corruption is a critical weakness that could be leveraged for higher impact if additional vulnerabilities are present.

The vulnerability affects the aria2 download utility, specifically all releases with version 1.37.0 or earlier. No specific vendor product hierarchy is reported, but the affected binary is the aria2 executable distributed by the project's maintainers.

The EPSS score indicates a very low probability of exploitation, with a value below 1%. The CVSS score of 4 denotes moderate severity. The likely attack vector is local or when the software processes untrusted files; remote exploitation would necessitate a scenario where untrusted input can be fed to aria2. This inference is based on the nature of the flaw and typical usage of the getLine() routine. The absence of public exploit data suggests that exploitation may not yet be demonstrated in the wild.