Executive brief
AllPlayer, a popular media player for Windows, contains a security flaw in how it handles web addresses (URLs). An attacker can trick a user into pasting a specially crafted, extremely long URL into the player's 'Open URL' dialog. If successful, this allows the attacker to take control of the application and run malicious commands on the user's computer with the same permissions as the logged-in user.
Technical details
A local buffer overflow vulnerability exists in AllPlayer 7.4 within the 'Open URL' dialog handling. The application fails to properly validate the length of input strings, allowing an attacker to provide an excessively long URL that overwrites Structured Exception Handling (SEH) pointers. This is a Unicode-based buffer overflow. By crafting a malicious payload that includes a specific junk padding, nSEH/SEH overwrites, and a Unicode-compatible shellcode, an attacker can gain arbitrary code execution. The attack requires the user to manually paste the malicious string into the application's interface. While the vendor has released newer versions (e.g., 9.6), users on version 7.4 remain vulnerable.
Affected products
- AllPlayer AllPlayer 7.4 and earlier
Timeline
- 2019-04-08: disclosed: Initial exploit code published on Exploit-DB
- 2026-06-04: advisory: CVE formally published and enriched by VulnCheck/NVD