CVE-2003-0765: Nullsoft Winamp

High severity, CVSS 7.5. EPSS: 7% chance of exploitation in the next 30 days.

The IN_MIDI.DLL plugin 3.01 and earlier, as used in Winamp 2.91, allows remote attackers to execute arbitrary code via a MIDI file with a large "Track data size" value.

Affected products

• Nullsoft Winamp: version 2.81 only; version 2.91 only; version 3.0 only; version 3.1 only

Published 2003-09-17. Last modified 2026-06-16.