CVE-2019-25689

CVE-2019-25689 is a local buffer overflow vulnerability affecting HTML5 Video Player version 1.2.5 that permits authenticated attackers to execute arbitrary code by injecting an oversized string exceeding 997 bytes into the KEY CODE field of the Help Register dialog. This allows threat actors to spawn arbitrary processes, such as calculator applications, on affected systems. The vulnerability carries a HIGH severity rating with a CVSS score of 7.8, reflecting high impact across confidentiality, integrity, and availability. Attack requirements are minimal, requiring only local access and low user privileges with no interaction needed, making it a straightforward exploitation path once an attacker gains initial system access. Current exploitation status indicates minimal public activity. The vulnerability is not tracked on the Known Exploited Vulnerabilities list, maintains an inactive status on threat tracking lists, and shows an extremely low Exploit Prediction Scoring System score of 0.00015, suggesting no known active exploitation in the wild. However, the FAUCET risk score of 50/100 warrants attention for systems with the affected software installed in sensitive environments.