A buffer overflow occurs in X360 VideoPlayer ActiveX Control (VideoPlayer.ocx) version 2.6 when the ConvertFile() method processes excessively long arguments. The overflow corrupts memory and allows an attacker to execute arbitrary code in the context of the current process. This type of flaw is a classic stack-based buffer overflow (CWE-120) and may also allow injection of malicious code (CWE-94), enabling remote code execution and full compromise of the affected system.

The vulnerability affects the X360Soft X360 VideoPlayer ActiveX Control released by X360Soft. The specific vulnerable version is 2.6. Systems running this ActiveX control, typically within Internet Explorer or other browsers that support ActiveX, are at risk. No other versions are currently listed as affected.

With a CVSS score of 8.6, the flaw is classified as high severity. An EPSS score of 52% indicates a high likelihood of exploitation in the wild, and there are documented proof‑of‑concept exploits in Metasploit and Exploit‑DB. The attack vector is likely through malicious web content that loads the ActiveX control and calls ConvertFile() with a crafted argument. Because the payload runs in the context of the current process, it can lead to full system takeover. The vulnerability is not yet listed in the CISA KEV catalog, but the presence of public exploits and the high EPSS suggest a significant threat.