CVE-2008-0486: Mplayer

High severity, CVSS 7.5. EPSS: 5.4% chance of exploitation in the next 30 days.

Array index vulnerability in libmpdemux/demux_audio.c in MPlayer 1.0rc2 and SVN before r25917, and possibly earlier versions, as used in Xine-lib 1.1.10, might allow remote attackers to execute arbitrary code via a crafted FLAC tag, which triggers a buffer overflow.

Affected products

• Mplayer Mplayer: version 1.02rc2 only
• Xine Xine-Lib: version 1.1.10 only

Published 2008-02-05. Last modified 2026-06-16.