CVE-2007-4619: Flac Libflac

High severity, CVSS 9.3. EPSS: 6.7% chance of exploitation in the next 30 days.

Multiple integer overflows in Free Lossless Audio Codec (FLAC) libFLAC before 1.2.1, as used in Winamp before 5.5 and other products, allow user-assisted remote attackers to execute arbitrary code via a malformed FLAC file that triggers improper memory allocation, resulting in a heap-based buffer overflow.

Affected products

• Flac Libflac: up to and including 1.2
• Nullsoft Winamp: up to and including 5.35

Published 2007-10-12. Last modified 2026-06-16.