A denial of service vulnerability in XMedia Recode 3.4.8.6 allows an attacker to crash the application by enticing a user to open a malicious .m3u playlist file.

This is a resource exhaustion flaw (CWE-770) where the application fails to properly validate the size of input provided within a .m3u playlist file. An unauthenticated attacker can cause an application crash by providing a crafted file that exceeds expected buffer limits.

The successful exploitation of this vulnerability results in an application crash, leading to service disruption for the user. While the CVSS score of 7.5 reflects a high severity due to the ease of exploitation, the impact is primarily limited to local denial of service, potentially causing loss of work or productivity for individuals relying on the software for media processing.

Immediate Action: Users should update to the latest available version of XMedia Recode to ensure protection against this and other known vulnerabilities. If an update is not immediately available, avoid opening untrusted or externally sourced .m3u playlist files.

Proactive Monitoring: Security teams should monitor workstation environments for frequent application crashes or unexpected terminations of the XMedia Recode process.

Compensating Controls: Implement endpoint protection policies that restrict the execution of media files from untrusted sources and utilize application whitelisting or sandboxing to limit the impact of potentially malicious file processing.

Public Exploit Available: Yes, a proof of concept exists via ExploitDB (EDB-ID 47679).

Given the availability of a public proof of concept and the relative ease of triggering this crash, administrators should prioritize updating XMedia Recode to a secure version. Users must exercise caution when handling playlist files from unverified sources to prevent service disruption until all systems are patched.