This vulnerability involves a classic buffer overflow (CWE-120) in the X360 VideoPlayer ActiveX Control (VideoPlayer.ocx) version 2.6. Specifically, the ConvertFile() method does not properly check the size of input arguments, allowing crafted inputs to overflow a buffer. This memory corruption can be leveraged to execute arbitrary code with the privileges of the running process. The CVSS 4.0 base score is 8.6, reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, and high impact on confidentiality, integrity, and availability.

Exploitation can lead to arbitrary code execution within the context of the current process, potentially compromising system confidentiality, integrity, and availability. The vulnerability is remotely exploitable without privileges but requires user interaction. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling or restricting use of the vulnerable ActiveX control, especially in environments where untrusted input might be processed. Monitor vendor channels for updates or official patches.