CVE-2008-5402: Cerulean Studios Trillian

High severity, CVSS 10.0. EPSS: 7% chance of exploitation in the next 30 days.

Double free vulnerability in the XML parser in Trillian before 3.1.12.0 allows remote attackers to execute arbitrary code via a crafted XML expression, related to the "IMG SRC ID."

Affected products

• Cerulean Studios Trillian: version 0.50 only; version 0.52 only; version 0.60 only; version 0.61 only; version 0.62 only; version 0.63 only; …
• Cerulean Studios Trillian Pro: any version; version 1.0 only; version 2.0 only; version 2.01 only; version 3.0 only; version 3.1.5.0 only; …
• Ceruleanstudios Trillian: any version; version 3.1.0.9 only; version 3.1.9.0 only
• Ceruleanstudios Trillian Pro: any version; version 3.1.9.0 only

Published 2008-12-10. Last modified 2026-06-16.