Arbitrary Code Execution via MKV Demuxer in VLC media player <=1.1.6.1

This repository contains a single Metasploit exploit module targeting a memory corruption vulnerability (CVE-2011-0531) in VideoLAN VLC media player versions prior to 1.1.7, specifically tested on VLC 1.1.6 running on Windows XP SP3. The exploit works by generating a specially crafted MKV or WebM file (default name: msf.webm) that, when opened in a vulnerable VLC instance, triggers a heap corruption via malformed EBML/segment data. The exploit uses a heap spray and a ROP chain to bypass DEP/NX protections and execute a customizable Metasploit payload, typically resulting in arbitrary code execution with user privileges. The module is operational and allows the attacker to specify the payload, making it flexible for various post-exploitation scenarios. The attack vector is local, requiring the victim to open the malicious file. No network endpoints are involved; the only fingerprintable endpoint is the generated file itself.