CVE-2010-20123

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2010-20123", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2025-08-20T20:33:55.844Z", "datePublished": "2025-08-21T20:14:21.267Z", "dateUpdated": "2026-05-15T11:13:38.051Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": [".m3u playlist file parser"], "product": "MyMP3Player", "vendor": "Steinberg", "versions": [{"lessThanOrEqual": "3.0.0.67", "status": "affected", "version": "0", "versionType": "custom"}]}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:steinberg:mymp3pro:*:*:*:*:*:*:*:*", "versionEndIncluding": "3.0.0.67"}]}]}], "credits": [{"lang": "en", "type": "finder", "value": "n3w7u"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Steinberg MyMP3Player version 3.0 (build 3.0.0.67) is vulnerable to a stack-based buffer overflow when parsing .m3u playlist files. The application fails to properly validate the length of input data within the playlist, allowing a specially crafted file to overwrite critical memory structures and execute arbitrary code. This vulnerability can be exploited locally by convincing a user to open a malicious .m3u file."}], "value": "Steinberg MyMP3Player version 3.0 (build 3.0.0.67) is vulnerable to a stack-based buffer overflow when parsing .m3u playlist files. The application fails to properly validate the length of input data within the playlist, allowing a specially crafted file to overwrite critical memory structures and execute arbitrary code. This vulnerability can be exploited locally by convincing a user to open a malicious .m3u file."}], "impacts": [{"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100 Overflow Buffers"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "baseScore": 8.4, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-121", "description": "CWE-121 Stack-based Buffer Overflow", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-05-15T11:13:38.051Z"}, "references": [{"tags": ["exploit"], "url": "https://www.exploit-db.com/exploits/11791"}, {"tags": ["exploit"], "url": "https://www.exploit-db.com/exploits/16633"}, {"tags": ["exploit"], "url": "https://www.exploit-db.com/exploits/14581"}, {"tags": ["exploit"], "url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/mymp3player_m3u.rb"}, {"tags": ["third-party-advisory"], "url": "https://www.fortiguard.com/encyclopedia/ips/20813/steinberg-mymp3player-buffer-overflow"}, {"tags": ["product"], "url": "https://www.chip.de/downloads/myMP3-Player_13008621.html"}, {"tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/steinburg-mymp3player-buffer-overflow"}], "source": {"discovery": "UNKNOWN"}, "tags": ["unsupported-when-assigned"], "title": "Steinberg MyMP3Player <= 3.0.0.67 Buffer Overflow", "x_generator": {"engine": "vulncheck"}, "datePublic": "2010-03-18T00:00:00.000Z"}, "adp": [{"references": [{"url": "https://www.exploit-db.com/exploits/11791", "tags": ["exploit"]}, {"url": "https://www.exploit-db.com/exploits/16633", "tags": ["exploit"]}, {"url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/mymp3player_m3u.rb", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-08-22T15:13:53.495749Z", "id": "CVE-2010-20123", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-22T15:13:59.364Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2010-20123", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-08-22T15:13:53.495749Z"}}}], "references": [{"url": "https://www.exploit-db.com/exploits/11791", "tags": ["exploit"]}, {"url": "https://www.exploit-db.com/exploits/16633", "tags": ["exploit"]}, {"url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/mymp3player_m3u.rb", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-22T15:13:45.501Z"}}], "cna": {"tags": ["unsupported-when-assigned"], "title": "Steinberg MyMP3Player <= 3.0.0.67 Buffer Overflow", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "n3w7u"}], "impacts": [{"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100 Overflow Buffers"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Steinberg", "modules": [".m3u playlist file parser"], "product": "MyMP3Player", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "3.0.0.67"}], "defaultStatus": "unaffected"}], "datePublic": "2010-03-18T00:00:00.000Z", "references": [{"url": "https://www.exploit-db.com/exploits/11791", "tags": ["exploit"]}, {"url": "https://www.exploit-db.com/exploits/16633", "tags": ["exploit"]}, {"url": "https://www.exploit-db.com/exploits/14581", "tags": ["exploit"]}, {"url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/mymp3player_m3u.rb", "tags": ["exploit"]}, {"url": "https://www.fortiguard.com/encyclopedia/ips/20813/steinberg-mymp3player-buffer-overflow", "tags": ["third-party-advisory"]}, {"url": "https://www.chip.de/downloads/myMP3-Player_13008621.html", "tags": ["product"]}, {"url": "https://www.vulncheck.com/advisories/steinburg-mymp3player-buffer-overflow", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck"}, "descriptions": [{"lang": "en", "value": "Steinberg MyMP3Player version 3.0 (build 3.0.0.67) is vulnerable to a stack-based buffer overflow when parsing .m3u playlist files. The application fails to properly validate the length of input data within the playlist, allowing a specially crafted file to overwrite critical memory structures and execute arbitrary code. This vulnerability can be exploited locally by convincing a user to open a malicious .m3u file.", "supportingMedia": [{"type": "text/html", "value": "Steinberg MyMP3Player version 3.0 (build 3.0.0.67) is vulnerable to a stack-based buffer overflow when parsing .m3u playlist files. The application fails to properly validate the length of input data within the playlist, allowing a specially crafted file to overwrite critical memory structures and execute arbitrary code. This vulnerability can be exploited locally by convincing a user to open a malicious .m3u file.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-121", "description": "CWE-121 Stack-based Buffer Overflow"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:steinberg:mymp3pro:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "3.0.0.67"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-05-15T11:13:38.051Z"}}}, "cveMetadata": {"cveId": "CVE-2010-20123", "state": "PUBLISHED", "dateUpdated": "2026-05-15T11:13:38.051Z", "dateReserved": "2025-08-20T20:33:55.844Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2025-08-21T20:14:21.267Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": [".m3u playlist file parser"], "product": "MyMP3Player", "vendor": "Steinberg", "versions": [{"lessThanOrEqual": "3.0.0.67", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [{"sourceIdentifier": "disclosure@vulncheck.com", "tags": ["unsupported-when-assigned"]}], "descriptions": [{"lang": "en", "value": "Steinberg MyMP3Player version 3.0 (build 3.0.0.67) is vulnerable to a stack-based buffer overflow when parsing .m3u playlist files. The application fails to properly validate the length of input data within the playlist, allowing a specially crafted file to overwrite critical memory structures and execute arbitrary code. This vulnerability can be exploited locally by convincing a user to open a malicious .m3u file."}, {"lang": "es", "value": "Steinberg MyMP3Player versi\u00f3n 3.0 (compilaci\u00f3n 3.0.0.67) es vulnerable a un desbordamiento de b\u00fafer basado en la pila al analizar archivos de listas de reproducci\u00f3n .m3u. La aplicaci\u00f3n no valida correctamente la longitud de los datos de entrada dentro de la lista de reproducci\u00f3n, lo que permite que un archivo especialmente manipulado sobrescriba estructuras de memoria cr\u00edticas y ejecute c\u00f3digo arbitrario. Esta vulnerabilidad puede explotarse localmente convenciendo al usuario para que abra un archivo .m3u malicioso."}], "id": "CVE-2010-20123", "lastModified": "2026-06-16T23:19:47.310", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2010-20123", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-08-22T15:13:53.495749Z", "version": "2.0.3"}}]}, "published": "2025-08-21T21:15:34.853", "references": [{"source": "disclosure@vulncheck.com", "url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/mymp3player_m3u.rb"}, {"source": "disclosure@vulncheck.com", "url": "https://www.chip.de/downloads/myMP3-Player_13008621.html"}, {"source": "disclosure@vulncheck.com", "url": "https://www.exploit-db.com/exploits/11791"}, {"source": "disclosure@vulncheck.com", "url": "https://www.exploit-db.com/exploits/14581"}, {"source": "disclosure@vulncheck.com", "url": "https://www.exploit-db.com/exploits/16633"}, {"source": "disclosure@vulncheck.com", "url": "https://www.fortiguard.com/encyclopedia/ips/20813/steinberg-mymp3player-buffer-overflow"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/steinburg-mymp3player-buffer-overflow"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/mymp3player_m3u.rb"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://www.exploit-db.com/exploits/11791"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://www.exploit-db.com/exploits/16633"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-121"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"created": "2025-08-23T11:53:19.752511+00:00", "updated": "2025-08-23T11:53:19.752579+00:00", "vendors": ["steinberg", "steinberg$PRODUCT$mymp3pro"]}