CVE-2019-25331: 
AVS Audio Converter vulnerability analysis and mitigation

CVE-2019-25331 is a stack-based buffer overflow vulnerability in AVS Audio Converter 9.1, affecting the application's 'Exit folder' input field. Local attackers can exploit this flaw by crafting a specially designed text file containing 264 bytes of padding followed by register overwrite values, enabling them to overwrite CPU registers and potentially execute arbitrary code. The vulnerability was published on February 12, 2026, and carries a CVSS v3.1 base score of 8.4 (High) (Feedly, CVE.org).

The root cause is a stack-based buffer overflow (CWE-121) in the 'Exit folder' input field of AVS Audio Converter 9.1. An attacker crafts a malicious text file with exactly 264 bytes of padding to overflow the stack buffer, followed by controlled values that overwrite CPU registers such as EIP, enabling redirection of execution flow. The attack vector is local, requires no privileges, and no user interaction is specified in the CVSSv3 scoring, though CVSSv4 notes active user interaction is required (e.g., opening the crafted file). No public proof-of-concept code has been confirmed at this time (Feedly, InfinitSec).

Successful exploitation allows a local attacker to overwrite CPU registers and execute arbitrary code within the context of the AVS Audio Converter application, resulting in high impact to confidentiality, integrity, and availability. An attacker could gain complete control over the affected system, modify or delete data, and disrupt application availability. The scope is limited to the local system, with no direct lateral movement capability, though code execution could facilitate privilege escalation or further post-exploitation activity (Feedly).

There is no confirmed public proof-of-concept exploit or evidence of in-the-wild exploitation for CVE-2019-25331 at this time. The EPSS score is approximately 0.013% (0.000130), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported (Feedly).

1. Reconnaissance: Identify a target system running AVS Audio Converter version 9.1 with local access or the ability to deliver a malicious file to the target user.
2. Craft malicious file: Create a specially designed text file containing 264 bytes of arbitrary padding (e.g., 'A' characters) to overflow the stack buffer in the 'Exit folder' input field, followed by controlled register overwrite values (e.g., a crafted EIP value pointing to shellcode or a ROP gadget).
3. Deliver the file: Deliver the crafted text file to the target system via social engineering, shared network drive, or physical access.
4. Trigger the vulnerability: Convince the target user (or directly interact) to load the malicious file into AVS Audio Converter 9.1 such that the 'Exit folder' field processes the crafted input.
5. Achieve code execution: The buffer overflow overwrites the return address or CPU registers, redirecting execution to attacker-controlled code, resulting in arbitrary code execution under the application's privileges (Feedly, InfinitSec).

• File System: Presence of unusually large or malformed text files (264+ bytes of repeated characters) in directories associated with AVS Audio Converter; unexpected files in the application's working directory.
• Process: AVS Audio Converter process (AVSAudioConverter.exe) spawning unexpected child processes (e.g., cmd.exe, powershell.exe) or crashing with access violation errors.
• Logs: Application crash logs or Windows Event Logs (Event ID 1000/1001) referencing AVSAudioConverter.exe with faulting module offsets consistent with stack corruption.

No official patch from AVS4YOU has been confirmed for this vulnerability. Users should restrict local access to systems running AVS Audio Converter 9.1 and avoid opening untrusted or unexpected text files with the application. If the software is not actively required, consider disabling or uninstalling it. Users should contact AVS4YOU directly for updates or check for a newer version of the software that may address this issue (Feedly).

RedPacket Security flagged the vulnerability via their CVE alert feed and Mastodon social media account shortly after publication (RedPacket Security). InfinitSec published a brief technical post covering the vulnerability details (InfinitSec). No significant vendor statements or broader media coverage have been identified.