Buffer overflow in Splayer Project
CVE-2011-10022
SPlayer version 3.7 and earlier is vulnerable to a stack-based buffer overflow when processing HTTP responses containing an overly long Content-Type header. The vulnerability occurs due to improper bounds checking on the header value, allowing an attacker to overwrite the Structured Exception Handler (SEH) and execute arbitrary code. Exploitation requires the victim to open a media file that triggers an HTTP request to a malicious server, which responds with a crafted Content-Type header.
Vulnerability class: Buffer Overflow
Published · last modified .
EPSS exploit prediction
EPSS: 0.008 (55.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 55th percentile — 55.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.008 · newest: 0.008 · change: 0.000
Affected products
- Splayer Project — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/w… (exploit)
- www.exploit-db.com/exploits/17243 (exploit)
- www.exploit-db.com/exploits/17268 (exploit)
- www.splayer.org/ (product)
- www.vulncheck.com/advisories/splayer-content-type-header-buffer-overflow (third-party-advisory)
Frequently asked questions
- What is CVE-2011-10022?
- CVE-2011-10022 is a vulnerability in Splayer Project, classified under Buffer Copy without Checking Size of Input (Classic Buffer Overflow). Published 2025-08-20.
- Is CVE-2011-10022 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.