CVE-2009-2499: Microsoft Windows 2000

High severity, CVSS 8.5. EPSS: 15.5% chance of exploitation in the next 30 days.

Microsoft Windows Media Format Runtime 9.0, 9.5, and 11; and Microsoft Media Foundation on Windows Vista Gold, SP1, and SP2 and Server 2008; allows remote attackers to execute arbitrary code via an MP3 file with crafted metadata that triggers memory corruption, aka "Windows Media Playback Memory Corruption Vulnerability."

Affected products

• Microsoft Windows 2000: affected versions not specified
• Microsoft Windows Media Format Runtime: version 9.0 only; version 9.5 only; version 11 only
• Microsoft Windows Media Foundation: affected versions not specified
• Microsoft Windows Media Services: version 9.1 only; version 2008 only
• Microsoft Windows Server 2003: any version
• Microsoft Windows Server 2008: affected versions not specified
• Microsoft Windows Vista: any version; affected versions not specified
• Microsoft Windows XP: affected versions not specified; any version

Published 2009-09-08. Last modified 2026-06-16.