CVE-2007-6403: Winamp Nullsoft Winamp

Medium severity, CVSS 6.8. EPSS: 3.4% chance of exploitation in the next 30 days.

Stack-based buffer overflow in Nullsoft Winamp 5.32 allows user-assisted remote attackers to execute arbitrary code via crafted unicode in a .mp4 file, with crafted tags, contained in a certain .rar archive, a related issue to CVE-2007-2498. NOTE: for exploitation, the victim must select a certain menu option at the time of the attack.

Affected products

• Winamp Nullsoft Winamp: version 5.32 only

Published 2007-12-17. Last modified 2026-06-16.