CVE-2010-10016
CVE-2010-10016 is a critical-severity vulnerability with a CVSS 4.0 base score of 10.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-120.
Key facts
- Severity: Critical (CVSS 4.0 base score 10.0)
- EPSS exploit prediction: 1% (49th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2010-5315
- Weakness: CWE-120
- Published:
- Last modified:
Description
BS.Player version 2.57 (build 1051) contains a vulnerability in its playlist import functionality. When processing .m3u files, the application fails to properly validate the length of playlist entries, resulting in a buffer overflow condition. This flaw occurs during parsing of long URLs embedded in the playlist, allowing overwrite of Structured Exception Handler (SEH) records. The vulnerability is triggered upon opening a crafted playlist file and affects the Unicode parsing logic in the Windows client.
Frequently asked questions
- What is CVE-2010-10016?
- BS.Player version 2.57 (build 1051) contains a vulnerability in its playlist import functionality. When processing .m3u files, the application fails to properly validate the length of playlist entries, resulting in a buffer overflow condition. This flaw occurs during parsing of long URLs embedded in the playlist, allowing overwrite of Structured Exception Handler (SEH) records. The vulnerability is triggered upon opening a crafted playlist file and affects the Unicode parsing logic in the Windows client.
- How severe is CVE-2010-10016?
- CVE-2010-10016 has a CVSS 4.0 base score of 10.0, rated critical severity.
- Is CVE-2010-10016 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (49th percentile), an estimate of the probability of exploitation in the next 30 days.
- How do I fix CVE-2010-10016?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
- Does CVE-2010-10016 have an EU (EUVD) identifier?
- Yes. CVE-2010-10016 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2010-5315.
- When was CVE-2010-10016 published?
- CVE-2010-10016 was published on 2025-08-30 and last updated on 2026-06-16.
References
- http://www.bsplayer.com/
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/bsplayer_m3u.rb
- https://www.exploit-db.com/exploits/15934
- https://www.exploit-db.com/exploits/18375
- https://www.vulncheck.com/advisories/bs-player-buffer-overflow-via-m3u-playlist-import
Other CWE-120 (Classic Buffer Overflow) vulnerabilities
- CVE-2025-48611 — Critical (CVSS 10.0): In DeviceId of DeviceId.java, there is a possible desync in persistence due to a missing bounds check. This could lead…
- CVE-2026-24823 — Critical (CVSS 10.0): Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in FASTSHIFT…
- CVE-2026-24810 — Critical (CVSS 10.0): Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in rethinkdb (src/cjson modules).…
- CVE-2026-24800 — Critical (CVSS 10.0): Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in tildearrow…
- CVE-2025-9962 — Critical (CVSS 10.0): A buffer overflow vulnerability in Novakon P series allows attackers to gain root permission without prior…
- CVE-2012-10035 — Critical (CVSS 10.0): Turbo FTP Server versions 1.30.823 and 1.30.826 contain a buffer overflow vulnerability in the handling of the PORT…
Browse all CWE-120 (Classic Buffer Overflow) vulnerabilities →