CVE-2023-53874
BaseFortify
Publication date: 2025-12-15
Last updated on: 2025-12-18
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| gomlab | gom_player | 2.3.90.5360 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-120 | The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a buffer overflow in GOM Player version 2.3.90.5360 that occurs in the equalizer preset name input field. An attacker can input a string of 260 'A' characters as the preset name, which exceeds the buffer size and causes the application to crash or become unstable. This happens because the application does not properly check the size of the input before copying it, leading to a classic buffer overflow issue. [2, 3]
How can this vulnerability impact me? :
The vulnerability can cause the GOM Player application to crash or become unstable when exploited. This results in a denial of service condition for the user. Since the attack requires local access and user interaction, it does not allow remote code execution or data compromise, but it can disrupt normal use of the application. [2, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by attempting to reproduce the buffer overflow condition locally on the affected GOM Player version 2.3.90.5360. Specifically, you can test by opening GOM Player, navigating to Settings > Audio > Equalizer, adding a new EQ preset, and inputting a string of 260 'A' characters into the preset name field to see if the application crashes or becomes unstable. There is also a proof-of-concept Python script that writes the 260-character payload to a file named "exploit.txt" which can be used as input to trigger the overflow. Since this is a local vulnerability, network detection commands are not applicable. [3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include avoiding the use of the equalizer preset name input field with overly long strings (specifically strings of 260 or more characters) in GOM Player version 2.3.90.5360. Users should refrain from adding or modifying equalizer presets with suspicious or unusually long names. Additionally, updating to a patched or newer version of GOM Player once available from the vendor is recommended. If no patch is available, consider restricting user access to the equalizer settings to prevent exploitation. [2, 3]