Subtitle Processor Buffer Overflow Vulnerability in .M3U File Parsing

A buffer overflow vulnerability has been identified in Subtitle Processor version 7.7.1, specifically within its .m3u file parser. The issue arises when the application processes a crafted playlist file. During this process, the application improperly handles input by converting it to Unicode and copying it into a fixed-size stack buffer without adequate bounds checking. This flaw enables an attacker to overwrite the Structured Exception Handler (SEH), potentially leading to arbitrary code execution.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system.

Reproduction

The vulnerability can be reproduced by creating a .m3u file that includes a long string of data. When this file is opened in Subtitle Processor 7.7.1, the application will convert the input into Unicode, expanding the string and causing it to overflow the stack buffer. This overflow can overwrite the SEH, allowing for the execution of arbitrary code.

Remediation

Users are advised not to open untrusted .m3u files. There is currently no known patch available for this vulnerability.