CVE-2009-3254

Ultimate Player 1.56 beta - Remote Code Execution via Long String in Playlist File

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2009-3254. PoCs published by hack4love.

AI-analyzed exploit summary This exploit targets a buffer overflow vulnerability in Ultimate Player v1.56 beta by crafting a malicious .m3u file. It leverages SEH overwrite with a hardcoded address and includes shellcode for potential arbitrary code execution.

Description

Multiple stack-based buffer overflows in Ultimate Player 1.56 beta allow remote attackers to execute arbitrary code via a long string in a (1) .m3u or (2) .upl playlist file.

Exploits (1)

exploitdb WORKING POC VERIFIED

by hack4love · perllocalwindows

https://www.exploit-db.com/exploits/9548

View Code ZIP pw:eip

This exploit targets a buffer overflow vulnerability in Ultimate Player v1.56 beta by crafting a malicious .m3u file. It leverages SEH overwrite with a hardcoded address and includes shellcode for potential arbitrary code execution.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: Ultimate Player v1.56 beta

No auth needed

Prerequisites: Victim must open the malicious .m3u file in Ultimate Player v1.56 beta

MITRE ATT&CK

T1203 - Exploitation for Client Execution T1059 - Command and Scripting Interpreter

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2

Core References

Vendor Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2009/2491

Exploit, Third Party Advisory exploit x_refsource_exploit-db

http://www.exploit-db.com/exploits/9548

Scores

EPSS 0.0477

EPSS Percentile 90.7%

Details

CWE

CWE-119

Status published

Products (1)

ultimatevideosite/ultimate_player 1.56 beta

Published Sep 18, 2009

Tracked Since Feb 18, 2026