Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2007-0018: Stack-based buffer overflow in the NCTAudioFile2.AudioFile ActiveX control (NCTAudioFile2.dll), as used by mul

62
This week
HIGH 9.3DOWNGRADEDOWNGRADEDOWNGRADE

CVE-2007-0018 is a high-severity flaw (CVSS 9.3) affecting convert mp3 master, mp3 record and edit audio master, mp3 wav converter. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Stack-based buffer overflow in the NCTAudioFile2.AudioFile ActiveX control (NCTAudioFile2.dll), as used by multiple products, allows remote attackers to execute arbitrary code via a long argument to the SetFormatLikeSample function. NOTE: the products include (1) NCTsoft NCTAudioStudio, NCTAudioEditor, and NCTDialogicVoice; (2) Magic Audio Recorder, Music Editor, and Audio Converter; (3) Aurora Media Workshop; DB Audio Mixer And Editor; (4) J. He

Why this priority

  • Critical severity
  • EPSS top 1%: very likely to be exploited
  • Public exploit reference

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score9.3 (High)
EPSS exploit chance37.3% (top 1%)
CISA exploited listNo
WeaknessCWE-119
Published2007-01-24
Last modified2026-06-16
Publisher (CNA): Flexera Software LLC · Vendor: altdo · americanshareware · audio edit magic · bearshare · cdburnerxp

Share: LinkedIn · X · Reddit

Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

altdo convert mp3 master DOWNGRADE
Affected: 1.1
Fixed in: no fixed release known
Safe to downgrade to: a release before 1.1
1. Check installed version
apt-cache policy convert-mp3-master || rpm -q convert-mp3-master || convert-mp3-master --version
2. No fixed release: DOWNGRADE to a release before 1.1 (Debian / Ubuntu)
apt-cache madison convert-mp3-master sudo apt install convert-mp3-master=<VERSION_BEFORE_1.1> sudo apt-mark hold convert-mp3-master
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list convert-mp3-master sudo dnf downgrade convert-mp3-master-<VERSION_BEFORE_1.1> sudo dnf versionlock add convert-mp3-master
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
altdo mp3 record and edit audio master DOWNGRADE
Affected: 1.2
Fixed in: no fixed release known
Safe to downgrade to: a release before 1.2
1. Check installed version
apt-cache policy mp3-record-and-edit-audio-master || rpm -q mp3-record-and-edit-audio-master || mp3-record-and-edit-audio-master --version
2. No fixed release: DOWNGRADE to a release before 1.2 (Debian / Ubuntu)
apt-cache madison mp3-record-and-edit-audio-master sudo apt install mp3-record-and-edit-audio-master=<VERSION_BEFORE_1.2> sudo apt-mark hold mp3-record-and-edit-audio-master
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list mp3-record-and-edit-audio-master sudo dnf downgrade mp3-record-and-edit-audio-master-<VERSION_BEFORE_1.2> sudo dnf versionlock add mp3-record-and-edit-audio-master
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
americanshareware mp3 wav converter DOWNGRADE
Affected: 3.1.8
Fixed in: no fixed release known
Safe to downgrade to: a release before 3.1.8
1. Check installed version
apt-cache policy mp3-wav-converter || rpm -q mp3-wav-converter || mp3-wav-converter --version
2. No fixed release: DOWNGRADE to a release before 3.1.8 (Debian / Ubuntu)
apt-cache madison mp3-wav-converter sudo apt install mp3-wav-converter=<VERSION_BEFORE_3.1.8> sudo apt-mark hold mp3-wav-converter
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list mp3-wav-converter sudo dnf downgrade mp3-wav-converter-<VERSION_BEFORE_3.1.8> sudo dnf versionlock add mp3-wav-converter
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
audio edit magic audio edit magic DOWNGRADE
Affected: 9.2.3_389
Fixed in: no fixed release known
Safe to downgrade to: a release before 9.2.3_389
1. Check installed version
apt-cache policy audio-edit-magic || rpm -q audio-edit-magic || audio-edit-magic --version
2. No fixed release: DOWNGRADE to a release before 9.2.3_389 (Debian / Ubuntu)
apt-cache madison audio-edit-magic sudo apt install audio-edit-magic=<VERSION_BEFORE_9.2.3_389> sudo apt-mark hold audio-edit-magic
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list audio-edit-magic sudo dnf downgrade audio-edit-magic-<VERSION_BEFORE_9.2.3_389> sudo dnf versionlock add audio-edit-magic
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
bearshare bearshare DOWNGRADE
Affected: 6.0.2.26789
Fixed in: no fixed release known
Safe to downgrade to: a release before 6.0.2.26789
1. Check installed version
apt-cache policy bearshare || rpm -q bearshare || bearshare --version
2. No fixed release: DOWNGRADE to a release before 6.0.2.26789 (Debian / Ubuntu)
apt-cache madison bearshare sudo apt install bearshare=<VERSION_BEFORE_6.0.2.26789> sudo apt-mark hold bearshare
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list bearshare sudo dnf downgrade bearshare-<VERSION_BEFORE_6.0.2.26789> sudo dnf versionlock add bearshare
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
cdburnerxp cdburnerxp pro DOWNGRADE
Affected: 3.0.116
Fixed in: no fixed release known
Safe to downgrade to: a release before 3.0.116
1. Check installed version
apt-cache policy cdburnerxp-pro || rpm -q cdburnerxp-pro || cdburnerxp-pro --version
2. No fixed release: DOWNGRADE to a release before 3.0.116 (Debian / Ubuntu)
apt-cache madison cdburnerxp-pro sudo apt install cdburnerxp-pro=<VERSION_BEFORE_3.0.116> sudo apt-mark hold cdburnerxp-pro
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list cdburnerxp-pro sudo dnf downgrade cdburnerxp-pro-<VERSION_BEFORE_3.0.116> sudo dnf versionlock add cdburnerxp-pro
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2007-0018?

convert mp3 master: downgrade or apply the listed mitigation; mp3 record and edit audio master: downgrade or apply the listed mitigation; mp3 wav converter: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2007-0018 being exploited?

CVE-2007-0018 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2007-0018 affect?

CVE-2007-0018 affects convert mp3 master, mp3 record and edit audio master, mp3 wav converter. Severity is high (CVSS 9.3). Stack-based buffer overflow in the NCTAudioFile2.AudioFile ActiveX control (NCTAudioFile2.dll), as used by multiple products, allows remote attackers to execute arbitrary code via a long argument to the SetFormatLikeSample function. NOTE: t

How urgent is CVE-2007-0018?

Priority 62/100. Critical severity; EPSS top 1%: very likely to be exploited; Public exploit reference

References

← Back to latest CVEs

Get the weekly exploited-CVE digest by emailThe CVEs being attacked this week and how to fix them. No spam, unsubscribe any time.