Read the docs
TI-2010-05052 Aliases CVE-2010-10016

BS.Player 2.57 Buffer Overflow via M3U Playlist Import

Priority HIGH 82CWE-120Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-120 and the CVSS impact.

Summary

BS.Player version 2.57 (build 1051) contains a vulnerability in its playlist import functionality. When processing .m3u files, the application fails to properly validate the length of playlist entries, resulting in a buffer overflow condition. This flaw occurs during parsing of long URLs embedded in the playlist, allowing overwrite of Structured Exception Handler (SEH) records. The vulnerability is triggered upon opening a crafted playlist file and affects the Unicode parsing logic in the Windows client.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01116 66th percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
BS.PlayerBS.Player Free and Pro Editionsup to 2.57 (build 1051)—No fix listedCNA
  • BS.Player Free and Pro Editions VendorBS.Player Affected up to 2.57 (build 1051) Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2010-10016

References

Exploit 3

Other 1

  • TI-2010-02999 Untrusted search path vulnerability in the Indeo Codec in iac25_32.ax in Microsoft… CVSS 2.0HIGH 9.3
  • TI-2009-01022 Stack-based buffer overflow in BS.Player (bsplayer) 2.32 Build 975 Free and 2.34 Build… CVSS 2.0HIGH 9.3
  • TI-2010-01920 Stack-based buffer overflow in BS.Global BS.Player 2.51 Build 1022 Free, and possibly… CVSS 2.0HIGH 9.3
  • TI-2008-06273 Buffer overflow in BS.player 2.27 build 959 allows remote attackers to cause a denial of… CVSS 2.0HIGH 9.3
  • TI-2010-01925 Stack-based buffer overflow in the media library in BS.Global BS.Player 2.51 build 1022… CVSS 2.0HIGH 9.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences