Vulnerability Spotlight: Total Commander File Info Plugin Denial of Service
Summary: Cisco Talos released an advisory for local denial of service flaws in the Total Commander FileInfo plugin, assigned CVE-2015-2869, with credit to Marcin Noga of Talos. An attacker controlling a COFF Archive Library (.lib) file can trigger an out of bounds read via overly large 'Size' or 'Number Of Symbols' field values, and one controlling a Linear Executable file can do the same via the 'Resource Table Count' or 'Object' fields, causing Total Commander to terminate unexpectedly; the flaws were tested against FileInfo 2.21 and 2.22.
Key Takeaway: The trigger is a file format users routinely handle, so a crafted .lib or Linear Executable file is enough to crash the application - and the advisory covers only FileInfo 2.21 and 2.22, leaving other versions unconfirmed.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2015-2869
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026