Executive brief
aMule is a popular open-source file-sharing application. A security flaw has been identified that allows a remote attacker to crash the application by sending a specially crafted server message. This results in a denial of service, preventing users from using the software to share or download files.
Technical details
A heap-based buffer overflow vulnerability exists in aMule version 2.3.3 within the OP_SERVERMESSAGE handler. The flaw is triggered when the application processes a malformed server message, leading to memory corruption. A remote, unauthenticated attacker can exploit this by sending a crafted network packet to a running aMule instance. Successful exploitation results in an immediate application crash (denial of service). While the primary impact is availability, heap overflows can sometimes be leveraged for further exploitation depending on the memory layout.
Affected products
- aMULE-Project aMule 2.3.3
Timeline
- 2026-07-14: disclosed: Initial disclosure via GitHub and NVD
- 2026-07-14: advisory