CVE-2019-25735

EUVD-2019-20171
AllPlayer 7.4 contains a local buffer overflow vulnerability in URL handling that allows attackers to overwrite structured exception handling pointers by supplying an excessively long URL string. Attackers can craft a malicious URL, paste it into the Open URL dialog, and trigger SEH-based code execution to run arbitrary commands with user privileges.
Classic Buffer Overflow
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
8.4 HIGH
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
allplayerallplayer
7.4
CNA
Common Weakness Enumeration
References
http://allplayer.org/Download/ALLPlayerEN.exe
https://www.allplayer.org/
https://www.exploit-db.com/exploits/46668
https://www.vulncheck.com/advisories/allplayer-local-buffer-overflow-via-seh-unicode