$ cve CVE-2007-4939 JSON

CVE-2007-4939 EXPLOIT

9.3

HIGH · CVSS 2.0 · EPSS 11.9% (pctl 96)

Patch early

A public exploit exists.

Description

Heap-based buffer overflow in mplayerc.exe in Media Player Classic (MPC) 6.4.9.0 and earlier, as used standalone and in mympc (aka CD-Storm) 1.0.0.1, StormPlayer 1.0.4, and possibly other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a .avi file with an "indx truck size" of 0xffffffff, and certain wLongsPerEntry and nEntriesInuse values.

Scoring

CVSS	9.3 (HIGH, v2.0)
Vector	AV:N/AC:M/Au:N/C:C/I:C/A:C
EPSS	11.91% — more likely to be exploited than 96% of all CVEs
Weakness	CWE-119
On CISA KEV	no
Public exploit	yes
Published	2007-09-18
Last modified	2026-06-16

Affected (3)

Vendor	Product
guliverkli	media player classic
mympc	cd-storm
verycd	stormplayer

Public exploits

Source	Title	Date
exploit-db	Media Player Classic 6.4.9 - Malformed AVI Header Multiple Remote Vulnerabilities	2007-09-12

References

→ the Explorer · watch your stack · NVD