Executive brief
aria2 is a lightweight file download manager used to fetch files via HTTP, HTTPS, and other protocols. Versions up to 1.37.0 contain a stack-buffer-underflow vulnerability that can be triggered when processing maliciously crafted input files, potentially allowing attackers to crash the application or execute arbitrary code with the privileges of the user running aria2.
Technical details
The vulnerability is a stack-buffer-underflow in the IOFile::getLine() function that occurs during parsing of URI list files. When aria2 processes a specially crafted input file via the -i flag, the getLine() function attempts to read from a stack buffer at an offset that underflows the allocated region, as confirmed by AddressSanitizer detection. The vulnerability is triggered during the URI list parsing phase in download_helper.cc without requiring authentication or special network access—only a maliciously crafted local file is needed. An attacker can exploit this to trigger a denial of service (crash) or potentially achieve code execution. A patch has been proposed via pull request #2376.
Affected products
- aria2 aria2 <=1.37.0
Timeline
- 2026-08-07: disclosed: Issue opened on GitHub
- 2026-08-25: advisory: CVE-2026-75421 published