CVE-2009-0263: Nullsoft Winamp

High severity, CVSS 10.0. EPSS: 16.7% chance of exploitation in the next 30 days.

Multiple buffer overflows in Winamp 5.541 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via (1) a large Common Chunk (COMM) header value in an AIFF file and (2) a large invalid value in an MP3 file.

Affected products

• Nullsoft Winamp: up to and including 5.541; version 2.0 only; version 2.4 only; version 2.5e only; version 2.6x only; version 2.7x only; …

Published 2009-01-23. Last modified 2026-06-16.