CVE-2009-0186: Mega-Nerd Libsndfile

High severity, CVSS 9.3. EPSS: 3.6% chance of exploitation in the next 30 days.

Integer overflow in libsndfile 1.0.18, as used in Winamp and other products, allows context-dependent attackers to execute arbitrary code via crafted description chunks in a CAF audio file, leading to a heap-based buffer overflow.

Affected products

• Mega-Nerd Libsndfile: up to and including 1.0.18; version 0.0.8 only; version 0.0.28 only; version 1.0.0 only; version 1.0.1 only; version 1.0.2 only; …
• Nullsoft Winamp: version 5.55 only; version 5.541 only

Published 2009-03-05. Last modified 2026-06-16.