CVE-2025-34128
X360 VideoPlayer ActiveX Control Buffer Overflow via ConvertFile()
Severity
High 8.6
CVSS 4.0
Exploited
Not listed
EPSS
0.013
68.7th percentile
Discovered by
Unknown
Vendor-published field
Published
Jul 16, 2025
Assigned by vulncheck
Description
A buffer overflow vulnerability exists in the X360 VideoPlayer ActiveX control (VideoPlayer.ocx) version 2.6 when handling overly long arguments to the ConvertFile() method. An attacker can exploit this vulnerability by supplying crafted input to cause memory corruption and execute arbitrary code within the context of the current process.
Weakness: CWE-120CWE-94
Affected products
| Vendor | Product | Category | Matched by |
|---|
No product mapping yet — this CVE is pending taxonomy review.
Vendor-reported products (1)
- X360Soft · X360 VideoPlayer ActiveX Control
Credit
Rh0
References
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/browser/x360_video_player_set_text_bof.rb
- https://rh0dev.github.io/blog/2015/fun-with-info-leaks/
- https://www.exploit-db.com/exploits/35948
- https://www.fortiguard.com/encyclopedia/ips/40167/x360-videoplayer-activex-control-buffer-overflow
- https://www.vulncheck.com/advisories/x360-videoplayer-activex-control-buffer-overflow
- https://www.exploit-db.com/exploits/36100