CVE-2003-0228

CVE-2003-0228 describes a directory traversal vulnerability in Microsoft Windows Media Player 7.1 and Windows Media Player for Windows XP. This flaw allows remote attackers to execute arbitrary code by crafting a malicious skins file containing hex-encoded backslash characters in a URL, leading to an executable being placed in an arbitrary system location. The vulnerability carries a CVSS score of 7.5, indicating high severity with network-based attacks requiring low complexity and resulting in partial confidentiality, integrity, and availability impacts. While not listed in CISA's KEV catalog, exploit code is publicly available via ExploitDB, though there is no evidence of active exploitation, Metasploit modules, or significant community discussion or media coverage.