CVE-2009-2498: Microsoft Media Foundation SDK

High severity, CVSS 9.3. EPSS: 21.2% chance of exploitation in the next 30 days.

Microsoft Windows Media Format Runtime 9.0, 9.5, and 11 and Windows Media Services 9.1 and 2008 do not properly parse malformed headers in Advanced Systems Format (ASF) files, which allows remote attackers to execute arbitrary code via a crafted (1) .asf, (2) .wmv, or (3) .wma file, aka "Windows Media Header Parsing Invalid Free Vulnerability."

Affected products

• Microsoft Media Foundation SDK: any version
• Microsoft Windows 2000: affected versions not specified
• Microsoft Windows Media Format Runtime: version 9.0 only; version 9.5 only; version 11 only
• Microsoft Windows Media Services: version 9.1 only; version 2008 only
• Microsoft Windows Server 2003: any version
• Microsoft Windows Server 2008: affected versions not specified
• Microsoft Windows Vista: any version; affected versions not specified
• Microsoft Windows XP: affected versions not specified; any version

Published 2009-09-08. Last modified 2026-06-16.