Buffer overflow in Zhengzhou Jinhui Computer System Engineering Co. Ltd. ; Beijing Dazheng Human Language Technology Academy Green Dam Youth Escort
CVE-2009-20008
Green Dam Youth Escort version 3.17 is vulnerable to a stack-based buffer overflow when processing overly long URLs. The flaw resides in the URL filtering component, which fails to properly validate input length before copying user-supplied data into a fixed-size buffer. A remote attacker can exploit this vulnerability by enticing a user to visit a specially crafted webpage containing a long URL, resulting in arbitrary code execution.
Vulnerability class: Buffer Overflow
Published · last modified .
EPSS exploit prediction
EPSS: 0.009 (58.6th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 59th percentile — 58.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.009 · newest: 0.009 · change: 0.000
Affected products
Weakness classification (CWE)
Public proof-of-concept exploits
References
- web.archive.org/web/20110426190759/http://www.cse.umich.edu/~jhalderm/pub/gd/ (technical-description)
- en.wikipedia.org/wiki/Green_Dam_Youth_Escort (product)
- www.exploit-db.com/exploits/8969 (exploit)
- www.exploit-db.com/exploits/8938 (exploit)
- raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/w… (exploit)
- www.vulncheck.com/advisories/green-dam-url-processing-buffer-overflow (third-party-advisory)
Frequently asked questions
- What is CVE-2009-20008?
- CVE-2009-20008 is a vulnerability in Zhengzhou Jinhui Computer System Engineering Co. Ltd. ; Beijing Dazheng Human Language Technology Academy Green Dam Youth Escort, classified under Stack-based Buffer Overflow. Published 2025-08-30.
- Is CVE-2009-20008 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.