CVE-2006-0708: Nullsoft Winamp

High severity, CVSS 9.3. EPSS: 7.2% chance of exploitation in the next 30 days.

Multiple buffer overflows in NullSoft Winamp 5.13 and earlier allow remote attackers to execute arbitrary code via (1) an m3u file containing a long URL ending in .wma, (2) a pls file containing a File1 field with a long URL ending in .wma, or (3) an m3u file with a long filename, variants of CVE-2005-3188 and CVE-2006-0476.

Affected products

• Nullsoft Winamp: version 5.0 only; version 5.01 only; version 5.02 only; version 5.03 only; version 5.04 only; version 5.05 only; …

Published 2006-02-15. Last modified 2026-06-16.