CVE-2012-10031

published 2025-08-05

CVE-2012-10031: BlazeVideo HDTV Player Pro v6.6.0.3 is vulnerable to a stack-based buffer overflow due to improper handling of user-supplied input embedded in .plf playlist…

Priority P2 59 high 8.6 CVSS 4.0

AV N AC L AT N PR N UI A VC H VI H VA H SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

EXPLOIT

BlazeVideo HDTV Player Pro v6.6.0.3 is vulnerable to a stack-based buffer overflow due to improper handling of user-supplied input embedded in .plf playlist files. When parsing a crafted .plf file, the MediaPlayerCtrl.dll component invokes PathFindFileNameA() to extract a filename from a URL-like string. The returned value is then copied to a fixed-size stack buffer using an inline strcpy call without bounds checking. If the input exceeds the buffer size, this leads to a stack overflow and potential arbitrary code execution under the context of the user.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
blazevideo_inc	hdtv_player_pro	—	—

Detection & IOCs extracted from sources · hover to see the quote

filename MediaPlayerCtrl.dll↗

filename .plf↗

• → Monitor for stack-based buffer overflow triggered by opening a crafted .plf playlist file in BlazeVideo HDTV Player Pro v6.6.0.3, specifically within the MediaPlayerCtrl.dll component via PathFindFileNameA() followed by an inline strcpy without bounds checking. ↗
• → Alert on BlazeVideo HDTV Player processes loading or executing code from MediaPlayerCtrl.dll when processing .plf files with abnormally long embedded strings, which may indicate exploitation of the filename handling routine. ↗

• · Exploitation occurs under the context of the logged-in user; impact is limited to user-level privileges unless combined with a privilege escalation. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-121