CVE-2004-1150: Nullsoft Winamp

Medium severity, CVSS 5.1. EPSS: 8.7% chance of exploitation in the next 30 days.

Stack-based buffer overflow in the in_cdda.dll plugin for Winamp 5.0 through 5.08c allows attackers to execute arbitrary code via a cda:// URL with a long (1) device name or (2) sound track number, as demonstrated with a .m3u or .pls playlist file.

Affected products

• Nullsoft Winamp: version 5.0 only; version 5.01 only; version 5.02 only; version 5.03 only; version 5.04 only; version 5.05 only; …

Published 2004-12-31. Last modified 2026-06-16.