CVE-2011-10008
HIGH EPSS 61.6%
Published Jul 31, 202511mo ago · Modified Jun 16, 20261w ago
8.6 CVSS 4.0
Published Jul 31, 2025 11mo ago
Last Modified Jun 16, 2026 1w ago
Description
A stack-based buffer overflow vulnerability exists in MPlayer Lite r33064 due to improper bounds checking when handling M3U playlist files containing long http:// URL entries. An attacker can craft a malicious .m3u file with a specially formatted URL that triggers a stack overflow when processed by the player, particularly via drag-and-drop interaction. This flaw allows for control of the execution flow through SEH overwrite and a DEP bypass using a ROP chain that leverages known gadgets in loaded DLLs. Successful exploitation may result in arbitrary code execution with the privileges of the current user.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction A
Scope X
Threat Intelligence
EPSS Exploit Probability
61.6% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 2
CWE-121
CWE-20 Improper Input Validation Validation
References 3
- raw.githubusercontent.com https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/mplayer_m3u_bof.rb
- exploit-db.com https://www.exploit-db.com/exploits/17013
- vulncheck.com https://www.vulncheck.com/advisories/mplayer-lite-r33064-m3u-stack-based-buffer-overflow
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.