CVE-2009-1788: Mega-Nerd Libsndfile

High severity, CVSS 9.3. EPSS: 8.2% chance of exploitation in the next 30 days.

Heap-based buffer overflow in voc_read_header in libsndfile 1.0.15 through 1.0.19, as used in Winamp 5.552 and possibly other media programs, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a VOC file with an invalid header value.

Affected products

• Mega-Nerd Libsndfile: version 1.0.15 only; version 1.0.16 only; version 1.0.17 only; version 1.0.18 only; version 1.0.19 only
• Nullsoft Winamp: version 5.5 only; version 5.51 only; version 5.52 only; version 5.54 only; version 5.55 only; version 5.541 only; …

Published 2009-05-26. Last modified 2026-06-16.