CVE-2025-34128

A buffer overflow vulnerability exists in the X360 VideoPlayer ActiveX control (VideoPlayer.ocx) version 2.6 when handling overly long arguments to the ConvertFile() method. An attacker can exploit this vulnerability by supplying crafted input to cause memory corruption and execute arbitrary code within the context of the current process.

CVSS v4.0

8.6 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS

0.85% chance of exploitation in the next 30 days, 56th percentile

Published

2025-07-16

Updated

2026-04-07

Proof-of-concept exploits (2)

• https://www.exploit-db.com/exploits/35948
• https://www.exploit-db.com/exploits/36100

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/x360_video_playe…

References

• CVE Record
• NVD entry

Related

• CVE-2025-34127
• CVE-2025-3413
• CVE-2025-34126
• CVE-2025-3414
• CVE-2025-34125
• CVE-2025-34141