A local buffer overflow vulnerability in DVDXPlayer Pro 5.5 allows an attacker to achieve arbitrary code execution by enticing a user to open a malicious playlist file.

The application is susceptible to a local buffer overflow due to improper handling of structured exception handling (SEH) when processing .plf playlist files. An attacker can craft a malicious file to overwrite a buffer and hijack the execution flow to run arbitrary code with the privileges of the application user.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the host machine, leading to a full compromise of the local system. Given the CVSS score of 8.4, this represents a high risk to data confidentiality, integrity, and availability. Unauthorized code execution could result in the installation of persistent backdoors, theft of sensitive local files, or lateral movement within the network.

Immediate Action: Since no official patch is available, users should immediately cease the use of DVDXPlayer Pro 5.5 and uninstall the software until a secure update is provided by the vendor.

Proactive Monitoring: Security teams should monitor endpoint logs for unusual child processes spawning from the media player or unexpected file system modifications associated with the application.

Compensating Controls: Implement endpoint protection solutions that utilize memory protection features, such as Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR), to disrupt exploitation attempts.

Public Exploit Available: Yes, a functional local exploit is publicly available via ExploitDB (EDB-ID: 46962).

This vulnerability presents a high risk due to the availability of public exploit code and the potential for complete system compromise. Organizations should prioritize the removal of the affected software from all workstations. If the software is required for business operations, it must be restricted to isolated environments where the risk of executing untrusted playlist files is minimized and monitoring is heightened.