AllPlayer 7.4 contains a local buffer overflow in its URL handling logic that allows an attacker to overwrite structured exception handling pointers. By supplying an excessively long URL string to the Open URL dialog, a malicious user can force the application to execute SEH-based code, leading to the ability to run arbitrary commands with the privileges of the logged‑in user. This local code execution can compromise the entire operating system if the user has administrative rights.

The vulnerability is limited to the AllPlayer 7.4 build from the Allplayer vendor. No other versions or vendors are indicated as affected in the available data.

The CVSS score of 8.6 indicates a high severity risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited. The attack vector is inferred to be local: an attacker must be able to cause a user to paste a crafted URL into the Open URL dialog or otherwise invoke the vulnerable functionality. Given the high severity and local privilege escalation potential, the risk to users remains significant until mitigated.