If you still have an old copy of Free Download Manager on your computer, a single imported file could hand a stranger the keys to your entire machine — without you clicking a single suspicious link.
Who Is Affected — and How Many People Are We Talking About?
Free Download Manager (FDM) has been downloaded tens of millions of times worldwide and remains one of the most recognized third-party download utilities on the internet, particularly among Windows power users who needed more control over large file downloads before browsers offered those features natively. The vulnerability tracked as CVE-2018-25304 specifically targets Free Download Manager version 2.0 Build 417 — an older but still widely installed release that many users never bothered to update or uninstall.
Anyone running this version on Windows is potentially exposed. That includes home users, small businesses running legacy setups, and enterprise environments where endpoint software inventories haven't been audited in years. Given how common "set it and forget it" software installations are, security researchers suspect this aging build is still sitting dormant on far more machines than most IT teams would be comfortable admitting.
What an Attacker Can Actually Do to You
Here's the scenario that should worry you. Imagine you receive an email, a forum post, or a cloud storage link that offers a pre-made "download list" — a simple file that promises to queue up a batch of software, movies, or tools you might want. Free Download Manager has a built-in feature for exactly this: you go to File → Import → Import lists of downloads, select the file, and the program starts working through the list automatically. It's a genuinely useful feature. It's also the door an attacker can walk right through.
If that import file has been crafted maliciously, the moment FDM tries to read the web address inside it, something goes wrong deep in the program's memory. The application attempts to store that address in a reserved block of memory, but the attacker has made the address grotesquely long — far longer than the program ever expected. The excess data spills out of its container like water overflowing a glass, and it lands precisely on top of the internal instructions the program uses to handle errors. At that point, the attacker isn't just crashing your software — they're replacing the program's emergency instructions with their own. The result is that their code runs on your machine, under your account, with your permissions.
From there, the playbook is familiar and grim. An attacker could install malware, ransomware, or a silent remote-access tool. They could steal saved passwords, documents, or financial data. They could use your machine as a launchpad to attack others on your network. And critically — none of this requires any visible warning. No popup. No antivirus alert (depending on the payload). Just a file you thought was a convenient shortcut, doing something very different in the background.
The Technical Detail That Matters
For security researchers, the interesting and particularly dangerous characteristic here is the exploitation mechanism: this is a Structured Exception Handler (SEH) chain overwrite triggered by a stack-based buffer overflow in the Location header parsing logic during URL list import. SEH overwrites are a classic but powerful exploitation class — by corrupting the exception handler pointers on the stack, an attacker gains reliable code execution even when standard overflow protections like stack cookies might otherwise complicate things. The vulnerability carries a CVSS score of 8.4 (HIGH), reflecting the severity of arbitrary code execution even within a local attack vector.
Has This Been Used in the Wild?
As of now, there is no confirmed evidence of active exploitation of CVE-2018-25304 in real-world attacks. The vulnerability was formally catalogued and disclosed through standard coordinated vulnerability reporting processes, and no known threat actor campaigns have been publicly attributed to it. However, the security community's guidance is consistent: the absence of confirmed exploitation today does not mean it won't happen tomorrow — especially for a bug with a public CVE identifier, a clearly documented attack path, and a high severity score. Once details are public, the clock starts ticking. Proof-of-concept code has a way of appearing quickly after disclosures like this.
It's also worth noting this isn't the first time FDM has made security headlines. In 2023, researchers uncovered a supply chain attack where the official FDM website was serving a trojanized Linux installer for nearly three years — demonstrating that this software's user base is a known and attractive target for threat actors.
What You Should Do Right Now
The fix here is straightforward, but you need to take all three steps:
- Uninstall Free Download Manager version 2.0 Build 417 immediately. Go to your system's Apps & Features (Windows) or equivalent, search for "Free Download Manager," check the version number, and remove it if it matches. Don't wait for an automatic update — this version is old enough that it may not receive one.
- If you need FDM, upgrade to version 6.22 or later from the official site only (freedownloadmanager.org). Version 6.x represents a complete rewrite with modern security architecture. Do not download it from third-party mirrors — given the supply chain history of this software, only the official domain should be trusted, and even then, verify the installer's SHA-256 hash against the one published on the download page.
-
Never import download lists from untrusted sources — and audit your existing import files. Going forward, treat any
.txt,.lst, or download-queue file from an unfamiliar sender the same way you'd treat a suspicious email attachment. If you have existing import files from unknown sources sitting on your machine, delete them now. The attack only requires you to open one.
CVE: CVE-2018-25304 | CVSS: 8.4 (HIGH) | Affected Version: Free Download Manager 2.0 Build 417 | Category: Buffer Overflow / SEH Chain Exploitation | Active Exploitation: Not confirmed as of publication