Rh0

A buffer overflow vulnerability exists in the X360 VideoPlayer ActiveX control (`VideoPlayer.ocx`) when handling overly long arguments to the `ConvertFile()` method. An attacker can exploit this vulnerability by supplying crafted input to cause memory corruption and execute arbitrary code within the context of the current process.

The issue allows attackers to cause a denial of service or possibly have other impact due to an out-of-bounds write. This is because the attacker controls the `pCreatePen->ihPen` array index in the `PlayEnhMetaFileRecord` function in `enhmetafile.c`.

The issue allows for a bypass of ASLR and DEP protections, potentially leading to memory corruption attacks. This is achieved through JIT-spray targeting asm.js combined with a heap spray.

The issue allows for a bypass of ASLR and DEP protections, potentially leading to memory corruption attacks. This is due to JIT code allocation.

The issue is related to a heap-based buffer overflow that can be triggered by foreign-context HTML5 fragments. This can be demonstrated by fragments within an SVG element, allowing remote attackers to execute arbitrary code.

The issue is a stack-based buffer overflow that allows remote attackers to execute arbitrary code. This is achieved by providing a long track name in an m3u playlist.

The issue is related to improper memory allocation in the browser engine, which can be exploited by remote attackers to cause a denial of service, resulting in memory corruption and application crash, or potentially execute arbitrary code.