CVE-2009-2527: Microsoft Windows Media Player

High severity, CVSS 9.3. EPSS: 26.9% chance of exploitation in the next 30 days.

Heap-based buffer overflow in Microsoft Windows Media Player 6.4 allows remote attackers to execute arbitrary code via (1) a crafted ASF file or (2) crafted streaming content, aka "WMP Heap Overflow Vulnerability."

Affected products

• Microsoft Windows Media Player: version 6.4 only

Published 2009-10-14. Last modified 2026-06-16.