Executive brief
River Past Ringtone Converter is a Windows application used to create custom ringtones from audio files. A vulnerability in the software's activation process allows a local user to crash the application by entering excessively long text into the registration fields. While this primarily results in a service outage for the specific user, it could disrupt operations for individuals relying on the software for media conversion.
Technical details
A local buffer overflow vulnerability exists in River Past Ringtone Converter version 2.7.6.1601 due to improper bounds checking on input fields. Specifically, the 'Email' textbox and 'Activation code' textarea within the 'Activate' dialog (accessible via the Help menu) do not sufficiently validate the length of user-supplied data. An attacker can trigger an out-of-bounds write (CWE-787) and subsequent application crash by pasting approximately 300 bytes of data into these fields. This is a local vulnerability requiring the attacker to have access to the application interface on the host machine. A public proof-of-concept exploit exists, but no official patch has been identified as the vendor's website appears to be defunct or repurposed.
Affected products
- River Past Ringtone Converter Project 2.7.6.1601
Timeline
- 2019-01-30: disclosed: Vulnerability discovered by Rafael Pedrero
- 2019-02-04: other: Exploit-DB proof of concept published
- 2026-04-05: advisory: CVE-2019-25665 published by NVD/VulnCheck