CVE-2023-53874 is a buffer overflow (CVSS 9.8 in the record) in GOM Player 2.3.90.5360, in the equalizer preset name input field. The documented effect is an application crash. No fixed version is confirmed, so install the newest build from the vendor and read the score with care.
What's affected
The CVE record and VulnCheck list GOM Player version 2.3.90.5360. The description says the equalizer preset name field can be overwritten past its buffer, causing the application to crash.
I could not confirm a fixed version from the sources available, so check the vendor site and release notes for a newer release. GOM Player is desktop software, so updating means installing the vendor's newest installer, or removing the player from machines that do not need it.
How to check if you're exposed
Open GOM Player, go to the About window and read the version. 2.3.90.5360 is the build named in the record. On managed Windows machines, use your software inventory to list installed versions of GOM Player.
Use of this player may be a policy question as well. If media players are not on your approved software list, finding GOM Player at all is a finding.
This is a desktop program, so the dependency scan at gold.safeguard.sh/scan will not see it. Use endpoint inventory tools instead.
What to do now
- List installs of GOM Player in your endpoint inventory.
- Install the newest build from the vendor, or remove the player where it is not needed.
- Prefer a media player that you already manage through your software distribution tool.
- Keep user installed software out of high privilege accounts.
Why it matters
The class is a classic buffer overflow (CWE-120): the program copies input into a fixed size area without checking its length, and the extra data spills into memory next to it. In the worst case, memory corruption lets an attacker run code. The advisory text for this entry documents only a crash.
The scores differ a lot. The NVD vector in the record is network reachable, with no privileges and no user action, giving 9.8. VulnCheck scores the same flaw 6.7 with a local vector that needs user action, which fits an input field in a desktop application much better. Use this as an example of why you should read the facts behind a score. The effect described is a crash of a local program, and the CVE is not on the CISA Known Exploited Vulnerabilities list.
Quick check
Is a 9.8 score realistic for this flaw?
The documented effect is an application crash through a local input field. VulnCheck scores it lower, at 6.7, with a local vector.
What should I do?
Update GOM Player to the newest build from the vendor, or remove it if it is not needed.
Sources
Last reviewed: 19 October 2026.
