Rapid7’s 2026 Global Cybersecurity Summit is now available on-demand.Watch sessions.
Rapid7

module

Xion Audio Player 1.0.126 Unicode Stack Buffer Overflow

Try Surface Command
Back to search
Disclosed
Nov 23, 2010
Created
May 30, 2018

Description

This module exploits a stack buffer overflow in Xion Audio Player prior to version
1.0.126. The vulnerability is triggered when opening a malformed M3U file that
contains an overly long string. This results in overwriting a
structured exception handler record.

Authors

hadji samir [email protected]
corelanc0d3r [email protected]
digital1
jduck [email protected]
m_101

Platform

Windows

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':


    msf > use exploit/windows/fileformat/xion_m3u_sehbof
    msf exploit(xion_m3u_sehbof) > show targets
        ...targets...
    msf exploit(xion_m3u_sehbof) > set TARGET < target-id >
    msf exploit(xion_m3u_sehbof) > show options
        ...show and set options...
    msf exploit(xion_m3u_sehbof) > exploit
Title
Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report