CVE-2019-25689 HTML5 Video Player 1.2.5 Local Buffer Overflow Non-SEH
Attackers can execute arbitrary code by pasting an oversized string into the Help Register dialog of HTML5 Video Player.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-25689?
CVE-2019-25689 is a high-severity memory corruption vulnerability in Html5Videoplayer HTML5 Video Player, published on 12 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
HTML5 Video Player 1.2.5 contains a local buffer overflow vulnerability that allows attackers to execute arbitrary code by supplying an oversized key code string. Attackers can craft a malicious payload exceeding 997 bytes and paste it into the KEY CODE field in the Help Register dialog to trigger code execution and spawn a calculator process.
Weakness: CWE-787
Which versions are affected by CVE-2019-25689?
It affects 1 product.
Products include Socusoft Html5 Video Player.
How do I fix CVE-2019-25689?
No fix has been published for CVE-2019-25689 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2019-25689 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2019-25689 exists.
Sources
Also known as GHSA-3x22-75pm-vfvc.