A vulnerability in HTML5 Video Player 1.2.5 occurs when the application reads a key code string that exceeds the internal buffer size. The overflow enables an attacker to inject malicious code, which can be executed in the context of the running process, as demonstrated by spawning a calculator process. The weakness is a classic buffer overflow (CWE‑787) and directly compromises the integrity and confidentiality of the system local to the user who opens the dialog.

The vulnerable product is the HTML5 Video Player from the bplugins vendor, version 1.2.5. Any installation of this specific version that allows the Help Register dialog to accept user input is affected.

The CVSS score of 8.6 indicates a high severity, and the vulnerability is local in nature, requiring user interaction to activate the exploit payload. No EPSS score is published, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited documented exploitation but still a significant risk due to the high base score and ease of tricking a user to enter the oversized string.