CVE-2009-0186
Integer overflow in libsndfile 1.0.18, as used in Winamp and other products, allows context...
Integer overflow in libsndfile 1.0.18, as used in Winamp and other products, allows context-dependent attackers to execute arbitrary code via crafted description chunks in a CAF audio file, leading to a heap-based buffer overflow.
Exploit likelihood
What each source reports
NVD Score used
Integer overflow in libsndfile 1.0.18, as used in Winamp and other products, allows context-dependent attackers to execute arbitrary code via crafted description chunks in a CAF audio file, leading to a heap-based buffer overflow.
- Record
CVE-2009-0186- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-189
- Updated
- 2026-11-02
CVE List No score
Integer overflow in libsndfile 1.0.18, as used in Winamp and other products, allows context-dependent attackers to execute arbitrary code via crafted description chunks in a CAF audio file, leading to a heap-based buffer overflow.
- Record
CVE-2009-0186- Updated
- 2026-11-02
EUVDEUVD-2009-0195 No score
Integer overflow in libsndfile 1.0.18, as used in Winamp and other products, allows context-dependent attackers to execute arbitrary code via crafted description chunks in a CAF audio file, leading to a heap-based buffer overflow.
- Record
EUVD-2009-0195- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2rcp-rgq6-h5hc No score
Integer overflow in libsndfile 1.0.18, as used in Winamp and other products, allows context...
Integer overflow in libsndfile 1.0.18, as used in Winamp and other products, allows context-dependent attackers to execute arbitrary code via crafted description chunks in a CAF audio file, leading to a heap-based buffer overflow.
- Record
GHSA-2rcp-rgq6-h5hc- Updated
- 2026-11-02
OSV No score
Integer overflow in libsndfile 1.0.18, as used in Winamp and other products, allows context-dependent attackers to execute arbitrary code via crafted description chunks in a CAF audio file, leading to a heap-based buffer overflow.
- Record
CVE-2009-0186- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-0186 No score
Integer overflow in libsndfile 1.0.18, as used in Winamp and other products, allows context-dependent attackers to execute arbitrary code via crafted description chunks in a CAF audio file, leading to a heap-based buffer overflow.
- Record
DEBIAN-CVE-2009-0186- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10148-1 No score
libsndfile-devel-1.0.26-2.4 on GA media
These are all security issues fixed in the libsndfile-devel-1.0.26-2.4 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10148-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10470-1 No score
libsndfile-progs-1.0.26-2.4 on GA media
These are all security issues fixed in the libsndfile-progs-1.0.26-2.4 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10470-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libsndfileDebian:12 |
before 1.0.19-1 | 1.0.19-1 |
libsndfileDebian:13 |
before 1.0.19-1 | 1.0.19-1 |
libsndfileDebian:14 |
before 1.0.19-1 | 1.0.19-1 |
libsndfileDebian:4.0 |
before 1.0.16-2+etch1, plus listed versions 1.0.16-11.0.16-2 |
1.0.16-2+etch1 |
libsndfileDebian:5.0 |
before 1.0.17-4+lenny1, plus listed versions 1.0.17-4 |
1.0.17-4+lenny1 |
libsndfileDebian:6.0 From an advisory covering 3 CVEs |
before 1.0.18-2+squeeze1 | 1.0.18-2+squeeze1 |
libsndfileopenSUSE:Tumbleweed From an advisory covering 6 CVEs |
before 1.0.26-2.4 | 1.0.26-2.4 |
libsndfile-progsopenSUSE:Tumbleweed From an advisory covering 5 CVEs |
before 1.0.26-2.4 | 1.0.26-2.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-0186 is a high vulnerability (CVSS 9.3) in Mega-nerd Libsndfile, published March 5, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.61%, the 89th percentile. Fixed in libsndfile 1.0.19-1.
References
vupen.com/english/advisories/2009/0585
security.gentoo.org/glsa/glsa-200904-16.xml
debian.org/security/2009/dsa-1742
securityfocus.com/archive/1/501413/100/0/threaded
secunia.com/advisories/33981
Show 23 moreShow less
securitytracker.com/id?1021784
exchange.xforce.ibmcloud.com/vulnerabilities/49038
lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html
ubuntu.com/usn/USN-749-1
mega-nerd.com/libsndfile/NEWS
nvd.nist.gov/vuln/detail/CVE-2009-0186
github.com/advisories/GHSA-2rcp-rgq6-h5hc
security-tracker.debian.org/tracker/CVE-2009-0186
suse.com/security/cve/CVE-2009-0186