CVE-2019-25689
Published: 12 April 2026
Summary
CVE-2019-25689 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Socusoft Html5 Video Player. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 10.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2019-25689 is a local buffer overflow vulnerability (CWE-787) affecting HTML5 Video Player version 1.2.5. The flaw occurs when an oversized key code string exceeding 997 bytes is supplied to the KEY CODE field in the Help Register dialog, leading to arbitrary code execution. The vulnerability carries a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), highlighting its high impact potential.
A local attacker can exploit this vulnerability by crafting a malicious payload and pasting it into the targeted field, triggering the buffer overflow and enabling execution of arbitrary code. A demonstrated outcome includes spawning a calculator process, with the attack requiring low complexity, no privileges, and no user interaction beyond local access.
References include the official download page at http://www.html5videoplayer.net/download.html, a proof-of-concept exploit on Exploit-DB (https://www.exploit-db.com/exploits/46279), and a VulnCheck advisory (https://www.vulncheck.com/advisories/html5-video-player-local-buffer-overflow-non-seh) describing it as a non-SEH overflow, with no patches or specific mitigations detailed.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-20124
Vulnerability details
HTML5 Video Player 1.2.5 contains a local buffer overflow vulnerability that allows attackers to execute arbitrary code by supplying an oversized key code string. Attackers can craft a malicious payload exceeding 997 bytes and paste it into the KEY CODE…
more
field in the Help Register dialog to trigger code execution and spawn a calculator process.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local buffer overflow enables direct arbitrary code execution in a client application via crafted input to a dialog field.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation of all information inputs, directly preventing buffer overflows from oversized key code strings in the Help Register dialog.
Implements memory protection mechanisms like address space layout randomization and data execution prevention to block arbitrary code execution from buffer overflows.
Mandates timely flaw remediation, including patching or removing vulnerable HTML5 Video Player versions to eliminate the buffer overflow vulnerability.