PT-2025-31529 · Undefined · Undefined

Published 2025-07-31 · Updated 2025-07-31 · CVE-2011-10008

NVD

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

A stack-based buffer overflow vulnerability exists in MPlayer Lite r33064 due to improper bounds checking when handling M3U playlist files containing long http:// URL entries. An attacker can craft a malicious .m3u file with a specially formatted URL that triggers a stack overflow when processed by the player, particularly via drag-and-drop interaction. This flaw allows for control of the execution flow through SEH overwrite and a DEP bypass using a ROP chain that leverages known gadgets in loaded DLLs. Successful exploitation may result in arbitrary code execution with the privileges of the current user.

Fix

RCE

Stack Overflow

Weakness Enumeration

CWE-20

CWE-121

Related Identifiers

CVE-2011-10008

Affected Products

Undefined

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2011-10008 · Security Note
• https://vulncheck.com/advisories/mplayer-lite-r33064-m3u-stack-based-buffer-overflow · Note
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/mplayer_m3u_bof.rb · Note
• https://exploit-db.com/exploits/17013 · Note