CVE-2025-34128
X360 VideoPlayer ActiveX Control Buffer Overflow via ConvertFile()
Severity
High 8.6
CVSS 4.0
Exploited
Not listed
EPSS
0.009
54.8th percentile
Discovered by
Unknown
Published by the vendor
Published
Jul 16, 2025
Assigned by vulncheck
Description
A buffer overflow vulnerability exists in the X360 VideoPlayer ActiveX control (VideoPlayer.ocx) version 2.6 when handling overly long arguments to the ConvertFile() method. An attacker can exploit this vulnerability by supplying crafted input to cause memory corruption and execute arbitrary code within the context of the current process.
Weakness: CWE-120CWE-94
Affected products
| Vendor | Product | Category | Matched by |
|---|
No product mapping yet — this CVE is pending taxonomy review.
Vendor-reported affected versions (1)
- X360Soft · X360 VideoPlayer ActiveX Control
Credit
Rh0
References
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/browser/x360_video_player_set_text_bof.rb
- https://rh0dev.github.io/blog/2015/fun-with-info-leaks/
- https://www.exploit-db.com/exploits/35948
- https://www.fortiguard.com/encyclopedia/ips/40167/x360-videoplayer-activex-control-buffer-overflow
- https://www.vulncheck.com/advisories/x360-videoplayer-activex-control-buffer-overflow
- https://www.exploit-db.com/exploits/36100