A buffer overflow vulnerability in Litexmedia YouTube Video Grabber 1.9.9.1 allows for remote code execution, posing a critical risk to affected Windows systems.

The application is susceptible to a stack-based buffer overflow via a crafted input string in the Name and Serial Number field. By leveraging Structured Exception Handler (SEH) manipulation, an unauthenticated attacker can trigger a bind shell connection on a local port.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code with the privileges of the user running the application. This could lead to full system compromise, data theft, or the installation of persistent malware. Given the CVSS score of 8.4, this flaw presents a high risk to organizational security and infrastructure integrity.

Immediate Action: There is currently no official patch available from the vendor; users should immediately cease use of this software and uninstall it from all systems.

Proactive Monitoring: Security teams should monitor network traffic for unexpected bind shell connections or unauthorized listener ports (specifically port 3110) associated with the application process.

Compensating Controls: Deploy endpoint protection solutions capable of detecting and blocking memory-based attacks or buffer overflow attempts. Ensure that application whitelisting policies prevent the execution of unauthorized or legacy tools.

Public Exploit Available: Yes, a functional exploit exists and is documented on Exploit-DB (EDB-ID: 50471).

The presence of a publicly available, functional exploit code makes this vulnerability an immediate concern for any environment where this software remains installed. Organizations must prioritize the removal of YouTube Video Grabber from all endpoints to eliminate the risk of arbitrary code execution. If the software is required for business operations, identify and transition to a modern, actively maintained alternative immediately.