{"id":"CVE-2010-10016","aliases":["EUVD-2010-5315"],"status":"published","title":"BS.Player 2.57 Buffer Overflow via M3U Playlist Import","description":"BS.Player version 2.57 (build 1051) contains a vulnerability in its playlist import functionality. When processing .m3u files, the application fails to properly validate the length of playlist entries, resulting in a buffer overflow condition. This flaw occurs during parsing of long URLs embedded in the playlist, allowing overwrite of Structured Exception Handler (SEH) records. The vulnerability is triggered upon opening a crafted playlist file and affects the Unicode parsing logic in the Windows client.","severity":{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01116,"percentile":0.66359,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-120"],"published":"2025-08-30T13:44:22Z","modified":"2026-06-16T23:17:19Z","exploits":[{"source":"metasploit","id":"exploit/windows/fileformat/bsplayer_m3u","title":"BS.Player 2.57 Buffer Overflow (Unicode SEH)","type":"exploit","platform":"Windows","date":"2010-01-07","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/windows/fileformat/bsplayer_m3u"}],"products":[{"vendor":"bs.player","product":"bs.player free and pro editions"}],"references":[{"url":"https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/bsplayer_m3u.rb","tags":["exploit"]},{"url":"https://www.exploit-db.com/exploits/15934","tags":["exploit"]},{"url":"https://www.exploit-db.com/exploits/18375","tags":["exploit"]},{"url":"http://www.bsplayer.com/","tags":["product"]},{"url":"https://www.vulncheck.com/advisories/bs-player-buffer-overflow-via-m3u-playlist-import","tags":["third-party-advisory"]}],"sources":{"cve":[{"id":"CVE-2010-10016","title":"BS.Player 2.57 Buffer Overflow via M3U Playlist Import","description":"BS.Player version 2.57 (build 1051) contains a vulnerability in its playlist import functionality. When processing .m3u files, the application fails to properly validate the length of playlist entries, resulting in a buffer overflow condition. This flaw occurs during parsing of long URLs embedded in the playlist, allowing overwrite of Structured Exception Handler (SEH) records. The vulnerability is triggered upon opening a crafted playlist file and affects the Unicode parsing logic in the Windows client.","status":"published","published":"2025-08-30T13:44:22.575Z","modified":"2026-05-15T11:13:22.859Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical","assessor":"cna"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:33:26.665532Z"}],"euvd":[{"id":"EUVD-2010-5315","description":"BS.Player version 2.57 (build 1051) contains a vulnerability in its playlist import functionality. When processing .m3u files, the application fails to properly validate the length of playlist entries, resulting in a buffer overflow condition. This flaw occurs during parsing of long URLs embedded in the playlist, allowing overwrite of Structured Exception Handler (SEH) records. The vulnerability is triggered upon opening a crafted playlist file and affects the Unicode parsing logic in the Windows client.","status":"published","published":"2025-08-30T13:44:22Z","modified":"2026-05-15T11:13:22Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"updated_at":"2026-11-02T19:04:30.03108Z"}],"nvd":[{"id":"CVE-2010-10016","description":"BS.Player version 2.57 (build 1051) contains a vulnerability in its playlist import functionality. When processing .m3u files, the application fails to properly validate the length of playlist entries, resulting in a buffer overflow condition. This flaw occurs during parsing of long URLs embedded in the playlist, allowing overwrite of Structured Exception Handler (SEH) records. The vulnerability is triggered upon opening a crafted playlist file and affects the Unicode parsing logic in the Windows client.","status":"published","published":"2025-08-30T14:15:37.18Z","modified":"2026-06-16T23:17:19.247Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:02:04.957683Z"}]}}