CVE-2009-0182: VUPlayer .pls playlist buffer overflow allows code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityThe flaw allows remote code execution with user interaction, public exploit code is available, and EPSS is high, though it is not in CISA KEV and affects an old, likely low-deployment product.

What it is

VUPlayer 2.49 and earlier contains a classic buffer overflow (CWE-120) triggered by an overly long URL in a File line of a .pls playlist file. Because the overflow is reachable through a crafted playlist, opening a malicious file can corrupt memory and lead to arbitrary code execution in the context of the user running the player.

Impact

An attacker who gets a victim to open a crafted .pls file can execute arbitrary code with the privileges of the VUPlayer process, giving full control of the user's session. The CVSS 3.1 vector rates confidentiality, integrity and availability impact as high.

Attack surface

The flaw is reached over the network in the sense that the malicious playlist can be delivered remotely, but exploitation requires the victim to open the .pls file, so user interaction is required and no authentication is needed. The CVSS vector is AV:N/AC:L/PR:N/UI:R.

Exploitation

Public exploit code exists, as multiple references are tagged Exploit and point to Exploit-DB and Packet Storm entries. The CVE is not listed in CISA KEV, but EPSS is high at roughly 0.48 probability (98.8th percentile), indicating elevated likelihood of exploitation activity.

What to do

• Upgrade VUPlayer to a version later than 2.49, or replace it with a maintained media player if no fixed release exists.
• Block or quarantine .pls files from untrusted sources at email and web gateways.
• Disable automatic opening or association of .pls playlists with VUPlayer where possible.
• Run VUPlayer with least privilege and avoid opening playlists from unknown origins.
• Apply exploit mitigation features such as DEP and ASLR on hosts that must run the affected player.

Detection

• Monitor for VUPlayer processes spawning unexpected child processes or making outbound connections after a playlist is opened.
• Alert on .pls files containing unusually long File or File1 URL lines, especially http URLs.
• Hunt for crash or exception events tied to VUPlayer when opening playlist files.
• Review endpoint telemetry for known exploit payload patterns associated with the published Exploit-DB and Packet Storm PoCs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.