CVE-2023-1745: KMPlayer SHFOLDER.dll uncontrolled search path

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-03-30 · updated 2026-06-17
Weakness: CWE-427

Description

A vulnerability, which was classified as problematic, has been found in KMPlayer 4.2.2.73. This issue affects some unknown processing in the library SHFOLDER.dll. The manipulation leads to uncontrolled search path. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The identifier VDB-224633 was assigned to this vulnerability.

Affected products

Pandora.tv KMPlayer: 4.2.2.73

References

https://drive.google.com/file/d/1bdYaDmtWhnjaHkzv3bZ4PUSMzDJ8JjSV/view
https://github.com/10cksYiqiyinHangzhouTechnology/KMPlayer_Poc
https://vuldb.com/?ctiid.224633
https://vuldb.com/?id.224633
https://youtu.be/7bh2BQOqxFo
https://drive.google.com/file/d/1bdYaDmtWhnjaHkzv3bZ4PUSMzDJ8JjSV/view
https://github.com/10cksYiqiyinHangzhouTechnology/KMPlayer_Poc
https://vuldb.com/?ctiid.224633
https://vuldb.com/?id.224633
https://youtu.be/7bh2BQOqxFo

Get alerted when CVE-2023-1745 or the next vulnerability affects your stack