Buffer overflow in Splayer Project
CVE-2011-10022
SPlayer version 3.7 and earlier is vulnerable to a stack-based buffer overflow when processing HTTP responses containing an overly long Content-Type header. The vulnerability occurs due to improper bounds checking on the header value, allowing an attacker to overwrite the Structured Exception Handler (SEH) and execute arbitrary code. Exploitation requires the victim to open a media file that triggers an HTTP request to a malicious server, which responds with a crafted Content-Type header.
Vulnerability class: Buffer Overflow
EPSS: 0.008 (53.0th percentile) — read the EPSS interpretation.
Affected products
- Splayer Project — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- disclosure@vulncheck.com (exploit)
- disclosure@vulncheck.com (exploit)
- disclosure@vulncheck.com (exploit)
- disclosure@vulncheck.com (product)
- disclosure@vulncheck.com (third-party-advisory)
Frequently asked questions
- What is CVE-2011-10022?
- CVE-2011-10022 is a vulnerability in Splayer Project, classified under Buffer Copy without Checking Size of Input (Classic Buffer Overflow). Published 2025-08-20.
- Is CVE-2011-10022 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.