Steinberg MyMP3Player Buffer Overflow Vulnerability in Playlist Parsing

A stack-based buffer overflow vulnerability has been identified in Steinberg MyMP3Player version 3.0 (build 3.0.0.67). The issue arises when the application parses .m3u playlist files, as it fails to properly validate the length of the input data. This oversight allows a specially crafted .m3u file to overwrite critical memory structures, leading to arbitrary code execution. The vulnerability can be exploited locally by persuading a user to open a malicious .m3u file.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system.

Reproduction

The vulnerability can be reproduced by creating a .m3u file that includes a payload designed to exploit the buffer overflow. This file can then be opened with Steinberg MyMP3Player version 3.0.0.67, triggering the overflow and executing the embedded code.