CVE-2006-1905

CVE-2006-1905 describes multiple format string vulnerabilities in xine 0.99.3, specifically within the xiTK component (xitk/main.c). This flaw allows remote attackers to execute arbitrary code by embedding format string specifiers in a long filename within an EXTINFO line of a playlist file. The vulnerability carries a CVSS score of 7.5, indicating high severity. It is easily exploitable over the network with low attack complexity and no authentication required, potentially leading to partial confidentiality, integrity, and availability compromise. While not listed in CISA's KEV catalog, an exploit for this vulnerability is publicly available on ExploitDB. Despite this, there is no evidence of active exploitation, and it has received no significant community discussion or media coverage.