CVE-2004-1896: Nullsoft Winamp

High severity, CVSS 7.6. EPSS: 5.1% chance of exploitation in the next 30 days.

Heap-based buffer overflow in in_mod.dll in Nullsoft Winamp 2.91 through 5.02 allows remote attackers to execute arbitrary code via a Fasttracker 2 (.xm) mod media file.

Affected products

• Nullsoft Winamp: version 2.91 only; version 3.0 only; version 3.1 only; version 5.0.1 only; version 5.0.2 only

Published 2004-12-31. Last modified 2026-06-16.