KISA 인터넷 보호나라&KrCERT

□ Overview

o KMPlayer has a integer underflow vulnerability. This results in a memory corruption and denial of service.

□ Description

o When processing subtitles format media file, KMPlayer doesn't check object size correctly, which leads to integer underflow then to memory out-of-bound read/write. An attacker can exploit this issue by enticing an unsuspecting user to open a malicious file. 

□ Affected Product

□ Solution

o Update to patched release version(2019.03.28.01)

□ Reference site

http://www.kmplayer.com/pc

□ Acknowledgements

o Thanks to anhdaden of STARlabs for reporting this vulerability.