PatchSiren

PatchSiren cyber security CVE debrief

CVE-2019-25735 Allplayer CVE debrief

CVE-2019-25735 is a local buffer overflow vulnerability in AllPlayer 7.4. The vulnerability occurs in the URL handling mechanism, where an excessively long URL string can be used to overwrite structured exception handling (SEH) pointers. This allows attackers to craft a malicious URL, paste it into the Open URL dialog, and trigger SEH-based code execution to run arbitrary commands with user privileges. The vulnerability has a CVSS score of 8.6 and is classified as HIGH severity.

Vendor
Allplayer
Product
Unknown
CVSS
HIGH 8.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-04
Original CVE updated
2026-07-22
Advisory published
2026-06-04
Advisory updated
2026-07-22

Who should care

Users of AllPlayer 7.4 should be aware of this vulnerability and take steps to mitigate it.

Technical summary

The vulnerability is caused by a buffer overflow in the URL handling mechanism of AllPlayer 7.4. An attacker can exploit this vulnerability by crafting a malicious URL and pasting it into the Open URL dialog, allowing them to execute arbitrary commands with user privileges.

Defensive priority

HIGH

Recommended defensive actions

  • Update to a patched version of AllPlayer, if available.
  • Use caution when opening URLs from untrusted sources.
  • Consider using alternative media players.

Evidence notes

The CVE record and NVD detail pages provide additional information about this vulnerability.

Sources and references

Verified primary and authoritative sources

  • CVE-2019-25735 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2019-25735

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2019-25735 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2019-25735

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.