CVE-2009-0475
Integer underflow in the Huffman decoding functionality (pvmp3_huffman_parsing.cpp) in OpenCORE 2...
Integer underflow in the Huffman decoding functionality (pvmp3_huffman_parsing.cpp) in OpenCORE 2.0 and earlier allows remote attackers to cause a denial of service (process crash) and possibly execute arbitrary code via a crafted MP3 file that triggers heap corruption.
Exploit likelihood
What each source reports
NVD Score used
Integer underflow in the Huffman decoding functionality (pvmp3_huffman_parsing.cpp) in OpenCORE 2.0 and earlier allows remote attackers to cause a denial of service (process crash) and possibly execute arbitrary code via a crafted MP3 file that triggers heap corruption.
- Record
CVE-2009-0475- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-189
- Updated
- 2026-11-02
CVE List No score
Integer underflow in the Huffman decoding functionality (pvmp3_huffman_parsing.cpp) in OpenCORE 2.0 and earlier allows remote attackers to cause a denial of service (process crash) and possibly execute arbitrary code via a crafted MP3 file that triggers heap corruption.
- Record
CVE-2009-0475- Updated
- 2026-11-02
EUVDEUVD-2009-0479 No score
Integer underflow in the Huffman decoding functionality (pvmp3_huffman_parsing.cpp) in OpenCORE 2.0 and earlier allows remote attackers to cause a denial of service (process crash) and possibly execute arbitrary code via a crafted MP3 file that triggers heap corruption.
- Record
EUVD-2009-0479- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jhqp-j8gr-8fxw No score
Integer underflow in the Huffman decoding functionality (pvmp3_huffman_parsing.cpp) in OpenCORE 2...
Integer underflow in the Huffman decoding functionality (pvmp3_huffman_parsing.cpp) in OpenCORE 2.0 and earlier allows remote attackers to cause a denial of service (process crash) and possibly execute arbitrary code via a crafted MP3 file that triggers heap corruption.
- Record
GHSA-jhqp-j8gr-8fxw- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-0475 is a medium vulnerability (CVSS 6.8) in Android Opencore, published February 11, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.20%, the 82nd percentile. No source names a fixed version.
References
securityfocus.com/bid/33673
android.git.kernel.org?p=platform/external/opencore.git%3Ba=commit%3Bh=7b466cd0ecfdba72c4cbd0f3a8c2001141376b0f
review.source.android.com/Gerrit
ocert.org/advisories/ocert-2009-002.html
nvd.nist.gov/vuln/detail/CVE-2009-0475
github.com/advisories/GHSA-jhqp-j8gr-8fxw