Executive brief
WinMTR is a network diagnostic tool used to monitor connection quality and identify packet loss. A vulnerability in version 0.91 allows an attacker to crash the application by providing it with a specially crafted input file. This results in a denial of service, preventing network administrators from using the tool to troubleshoot connectivity issues.
Technical details
A classic buffer overflow (CWE-120) exists in WinMTR 0.91 due to insufficient bounds checking when processing input data. An attacker can trigger this condition by providing a malformed payload file containing a large buffer of repeated characters (approximately 238 bytes). When the application attempts to process this oversized input, it triggers a buffer overflow that leads to an immediate application crash. While the vulnerability is documented as a denial of service, version 0.92 was released to address various bugs, and users are encouraged to update to the latest version.
Affected products
- WinMTR WinMTR 0.91 and earlier
Timeline
- 2018-11-01: disclosed: Initial proof of concept published on Exploit-DB
- 2026-05-30: advisory: CVE record published and enriched by VulnCheck/NVD