CVE-2023-53875CWE-319

GOM Player 2.3.90.5360 Remote Code Execution via Insecure IE Component

High · published December 15, 2025

CVSS v4.0
7.5
EPSS
0%
Percentile
37.7
In the wild
Unconfirmed
What it is

🚨 A malicious URL is all it takes here! GOM Player 2.3.90.5360's Internet Explorer component has a sneaky remote code execution vulnerability that could leave your system wide open! ⚡ Think of it like a clever con artist delivering a fake invitation to an exclusive party. Once inside, they can take complete control, just like attackers can run arbitrary code on your system by exploiting this flaw. An attacker could use this vulnerability to execute arbitrary code, potentially allowing them to install malware, steal sensitive data, or gain unauthorized access to your system. This can lead to absolute chaos, from your files being compromised to complete takeovers of your system!

Put simply

Think of it like a clever con artist delivering a fake invitation to an exclusive party. Once inside, they can take complete control, just like attackers can run arbitrary code on your system by exploiting this flaw. The vulnerability lies in the Internet Explorer component of GOM Player, which allows attackers to exploit DNS spoofing techniques. By redirecting victims to malicious URLs, attackers can execute code on the victim's machine through SMB server interactions.

What to do

An attacker could use this vulnerability to execute arbitrary code, potentially allowing them to install malware, steal sensitive data, or gain unauthorized access to your system. This can lead to absolute chaos, from your files being compromised to complete takeovers of your system! Users should immediately update GOM Player to the latest version, ensuring they are no longer running the vulnerable 2.3.90.5360. Additionally, be cautious with URL shortcuts and consider disabling unnecessary components within the application for extra security. You've got this! Stay proactive and your system will be stronger than ever! 🛡️

The record
Technical detail
CVSS v4.0
7.5 · HIGH
Vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00445 · 37.7th percentile
Weakness
CWE-319 · Cleartext Transmission of Sensitive Information
Published
2025-12-15T20:28Z
EPSS history
Timeline
  • 15 DEC 20:28Z
    GOM Player 2.3.90.5360 Remote Code Execution via Insecure IE Component
    cvelistv5