CVE-2009-1791: Mega-Nerd Libsndfile

High severity, CVSS 9.3. EPSS: 6.5% chance of exploitation in the next 30 days.

Heap-based buffer overflow in aiff_read_header in libsndfile 1.0.15 through 1.0.19, as used in Winamp 5.552 and possibly other media programs, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via an AIFF file with an invalid header value.

Affected products

• Mega-Nerd Libsndfile: version 1.0.15 only; version 1.0.16 only; version 1.0.17 only; version 1.0.18 only; version 1.0.19 only
• Nullsoft Winamp: version 5.5 only; version 5.51 only; version 5.52 only; version 5.54 only; version 5.55 only; version 5.541 only; …

Published 2009-05-26. Last modified 2026-06-16.