X360 VideoPlayer ActiveX Control Buffer Overflow Vulnerability Allowing Remote Code Execution

A buffer overflow vulnerability has been identified in the X360 VideoPlayer ActiveX control (VideoPlayer.ocx) version 2.6. The issue arises when the control's ConvertFile() method is fed excessively long arguments, leading to memory corruption. This vulnerability can be exploited to execute arbitrary code within the context of the current process.

Impact

Exploitation of this vulnerability allows for remote code execution on the affected system.

Reproduction

The vulnerability can be reproduced by creating an ActiveX object of the X360 VideoPlayer control in Internet Explorer 10 on a Windows 7 64-bit system. Once the object is created, the ConvertFile() method can be called with a specially crafted string that exceeds the buffer limit. This overflow can then be exploited by manipulating the ActiveX object's methods to execute arbitrary code.