CVE-2007-6262

VideoLAN VLC 0.8.6 - Remote Code Execution via Crafted ActiveX Control Arguments

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2007-6262. PoCs published by Ricardo Narvaja.

AI-analyzed exploit summary This exploit targets a memory corruption vulnerability in the VLC ActiveX control (axvlc.dll) by manipulating pointer initialization. It uses a heap spray technique with NOP sleds and shellcode to achieve arbitrary code execution.

Description

A certain ActiveX control in axvlc.dll in VideoLAN VLC 0.8.6 before 0.8.6d allows remote attackers to execute arbitrary code via crafted arguments to the (1) addTarget, (2) getVariable, or (3) setVariable function, resulting from a "bad initialized pointer," aka a "recursive plugin release vulnerability."

Exploits (1)

exploitdb WORKING POC VERIFIED

by Ricardo Narvaja · htmldoswindows

https://www.exploit-db.com/exploits/4688

View Code ZIP pw:eip

This exploit targets a memory corruption vulnerability in the VLC ActiveX control (axvlc.dll) by manipulating pointer initialization. It uses a heap spray technique with NOP sleds and shellcode to achieve arbitrary code execution.

Classification

Working Poc 90%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: VLC media player versions 0.86, 0.86a, 0.86b, 0.86c

No auth needed

Prerequisites: Victim must visit a malicious webpage hosting the exploit · VLC ActiveX control must be installed and enabled

MITRE ATT&CK