A local buffer overflow vulnerability in HTML5 Video Player 1.2.5 enables unauthenticated local attackers to achieve arbitrary code execution.

The application contains a local buffer overflow vulnerability (CWE-787) triggered when a user inputs an oversized string into the KEY CODE field within the Help Register dialog. An unauthenticated local attacker can leverage this to overwrite memory and execute arbitrary code on the host system.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code with the privileges of the user running the application. This could lead to full system compromise, unauthorized access to sensitive data, or the installation of persistent malware. Given the CVSS score of 8.4, this flaw poses a high risk to environment integrity and confidentiality.

Immediate Action: Update to the latest version of the software if a patch is available from the vendor, or discontinue use of the product if it is no longer supported.

Proactive Monitoring: Monitor endpoint logs for suspicious child processes, such as unexpected command shells or system utilities, spawning from the video player process.

Compensating Controls: Restrict execution permissions on the application folder to prevent unauthorized modification or execution of malicious payloads if the software must remain in use.

Public Exploit Available: Yes, a functional local exploit exists on Exploit-DB (EDB-ID: 46279).

The presence of a published proof-of-concept exploit significantly increases the risk of this vulnerability being leveraged in targeted attacks. Organizations currently running HTML5 Video Player 1.2.5 should prioritize upgrading to a secure version or removing the application from their environment entirely to eliminate the risk of local code execution.