Vulnerability · Published Jul 16, 2025 · Assigned by VulnCheck
CVE-2025-34128X360 VideoPlayer ActiveX Control Buffer Overflow via ConvertFile()
High 8.6
In plain English
A high-severity buffer overflow in X360 VideoPlayer ActiveX Control from X360Soft. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit.
Official description
A buffer overflow vulnerability exists in the X360 VideoPlayer ActiveX control (VideoPlayer.ocx) version 2.6 when handling overly long arguments to the ConvertFile() method. An attacker can exploit this vulnerability by supplying crafted input to cause memory corruption and execute arbitrary code within the context of the current process.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| X360Soft | X360 VideoPlayer ActiveX Control | 2.6 |
Weakness: CWE-120, CWE-94 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/browser/x360_video_player_set_text_bof.rb exploit
- https://rh0dev.github.io/blog/2015/fun-with-info-leaks/ third-party-advisory, technical-description
- https://www.exploit-db.com/exploits/35948 exploit
- https://www.fortiguard.com/encyclopedia/ips/40167/x360-videoplayer-activex-control-buffer-overflow third-party-advisory
- https://www.vulncheck.com/advisories/x360-videoplayer-activex-control-buffer-overflow third-party-advisory
- https://www.exploit-db.com/exploits/36100 exploit