Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

VUPlayer allows attackers to run code via crafted M3U file

CVE-2006-6251 · published 19 years ago
Summary

Versions of VUPlayer up to 2.44 can be tricked by a specially made playlist (M3U) file that contains a very long name. When such a file is opened, it can cause the program to run unwanted code on the computer. Update VUPlayer to a newer version or avoid opening playlist files from unknown sources.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
vuplayer vuplayer <= 2.44
cpe:2.3:a:vuplayer:vuplayer:*:*:*:*:*:*:*:*
Original advisory text
Stack-based buffer overflow in VUPlayer 2.44 and earlier allows remote attackers to execute arbitrary code via a long string in an M3U file, aka an "M3U UNC Name" attack.
Stack-based buffer overflow in VUPlayer 2.44 and earlier allows remote attackers to execute arbitrary code via a long string in an M3U file, aka an "M3U UNC Name" attack.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
68% chance of attack within 30 days
Timeline
Published4 Dec 2006
Updated29 Sep 2026
First seen29 Sep 2026
Sources
CVE-2006-6251 · NVD
Track software like this
Free during beta