CVE-2009-4356: Nullsoft Winamp

High severity, CVSS 9.3. EPSS: 5% chance of exploitation in the next 30 days.

Multiple integer overflows in the jpeg.w5s and png.w5s filters in Winamp before 5.57 allow remote attackers to execute arbitrary code via malformed (1) JPEG or (2) PNG data in an MP3 file.

Affected products

• Nullsoft Winamp: up to and including 5.56; version 0.20a only; version 0.92 only; version 1.006 only; version 1.90 only; version 2.0 only; …

Published 2009-12-18. Last modified 2026-06-16.