Exploitation Summary
EIP tracks 3 public exploits for CVE-2025-34128.
PoCs published by Metasploit, Rh0, Rh0, juan vazquez, including Metasploit module exploits/windows/browser/x360_video_player_set_text_bof.
AI-analyzed exploit summary This Metasploit module exploits a buffer overflow in the X360 VideoPlayer ActiveX control via the 'ConvertFile()' method to bypass ASLR/DEP and execute arbitrary code. It uses a combination of heap spraying and ROP techniques to achieve remote code execution on Windows systems.
Description
A buffer overflow vulnerability exists in the X360 VideoPlayer ActiveX control (VideoPlayer.ocx) version 2.6 when handling overly long arguments to the ConvertFile() method. An attacker can exploit this vulnerability by supplying crafted input to cause memory corruption and execute arbitrary code within the context of the current process.
Exploits (3)
This Metasploit module exploits a buffer overflow in the X360 VideoPlayer ActiveX control via the 'ConvertFile()' method to bypass ASLR/DEP and execute arbitrary code. It uses a combination of heap spraying and ROP techniques to achieve remote code execution on Windows systems.
This exploit leverages a buffer overflow in the X360 VideoPlayer ActiveX Control to achieve arbitrary memory read/write, bypassing ASLR and DEP. It uses heap spraying and controlled memcpy to corrupt typed array structures, leading to remote code execution via shellcode.
This Metasploit module exploits a buffer overflow in the X360 VideoPlayer ActiveX control via the 'SetText' method, bypassing ASLR/DEP to achieve remote code execution. It uses a combination of heap spraying, ROP chains, and stack manipulation to execute arbitrary payloads.
References (6)
Scores
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N