Media Player Classic .FLI File Processing Buffer Overflow Vulnerability

A highly critical vulnerability has been discovered in the open source media player Media Player Classic (MPC), which can be exploited by malicious people to compromise a vulnerable system. The vulnerability is caused due to a boundary error processing .FLI files (an old animation compression format). This vulnerability can be exploited to cause a buffer overflow when a malicious FLI file is opened (e.g. user is tricked into opening an .FLI file from an email or website). Successful exploitation of this vulnerability allows a remote attacker to execute arbitrary code on the vulnerable system. At this time there have been no reported incidences of this exploit from Purdue hosts.

*Media Player Classic
*Other versions may also be affected.
NOTE: Media Player Classic is included in many third party Codec packs also.

Do not open untrusted .FLI files.

Secunia Advisory SA26591:

Heise Security Advisory:

Media Player Classic download site:

Posted by Nathan Heck on August 29, 2007, in Handlers Log.

Purdue University, 610 Purdue Mall, West Lafayette, IN 47907, (765) 494-4600

© 2016 Purdue University | An equal access/equal opportunity university | Integrity Statement | Copyright Complaints | Maintained by ITaP

Trouble with this page? Disability-related accessibility issue? Please contact ITaP at

PDF files can be viewed in Adobe Acrobat Reader.