QwikSec

Security Database

CVE

CWE

Training

CVE-2010-20042

Published: Aug 20, 2025

Modified: May 25, 2026

PUBLISHED

Description

Xion Audio Player versions 1.0.126 and prior are vulnerable to a Unicode-based stack buffer overflow triggered by opening a specially crafted .m3u playlist file. The file contains an overly long string that overwrites the Structured Exception Handler (SEH) chain, allowing an attacker to hijack execution flow and run arbitrary code.

Vendor	Product	Versions
Xion	Audio Player	affected `0 - <= 1.0.126`

Weaknesses (CWE)

References

https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/xion_m3u_sehbof.rb

exploit

https://www.exploit-db.com/exploits/14517

exploit

https://www.exploit-db.com/exploits/14633

exploit

https://www.exploit-db.com/exploits/15598

exploit

https://www.exploit-db.com/exploits/16653

exploit

https://www.r2.com.au/page/products/download/xion-audio-player/

product

https://www.vulncheck.com/advisories/xion-audio-player-unicode-stack-buffer-overflow

third-party-advisory

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.