Description
The DHTML capability in Microsoft Windows Media Player (WMP) 6.4, 7.0, 7.1, and 9 may run certain URL commands from a security zone that is less trusted than the current zone, which allows attackers to bypass intended access restrictions.
References (3)
Core 3
Core References
Vendor Advisory vendor-advisory
x_refsource_mskb
http://support.microsoft.com/default.aspx?scid=kb%3Ben-us%3B828026
US Government Resource third-party-advisory
x_refsource_cert-vn
http://www.kb.cert.org/vuls/id/222044
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/13375
Scores
EPSS
0.0518
EPSS Percentile
91.7%
Details
Status
published
Products (4)
microsoft/windows_media_player
6.4
microsoft/windows_media_player
7
microsoft/windows_media_player
7.1
microsoft/windows_media_player
9
Published
Dec 31, 2003
Tracked Since
Feb 18, 2026