CVE-2009-2628
The VMnc media codec in vmnc.dll in VMware Movie Decoder before 6.5.3 build 185404, VMware...
The VMnc media codec in vmnc.dll in VMware Movie Decoder before 6.5.3 build 185404, VMware Workstation 6.5.x before 6.5.3 build 185404, VMware Player 2.5.x before 2.5.3 build 185404, and VMware ACE 2.5.x before 2.5.3 build 185404 on Windows does not properly handle certain small heights in video content, which might allow remote attackers to execute arbitrary code via a crafted AVI file that triggers heap memory corruption.
Exploit likelihood
What each source reports
NVD Score used
The VMnc media codec in vmnc.dll in VMware Movie Decoder before 6.5.3 build 185404, VMware Workstation 6.5.x before 6.5.3 build 185404, VMware Player 2.5.x before 2.5.3 build 185404, and VMware ACE 2.5.x before 2.5.3 build 185404 on Windows does not properly handle certain small heights in video content, which might allow remote attackers to execute arbitrary code via a crafted AVI file that triggers heap memory corruption.
- Record
CVE-2009-2628- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-94
- Updated
- 2026-11-02
CVE List No score
The VMnc media codec in vmnc.dll in VMware Movie Decoder before 6.5.3 build 185404, VMware Workstation 6.5.x before 6.5.3 build 185404, VMware Player 2.5.x before 2.5.3 build 185404, and VMware ACE 2.5.x before 2.5.3 build 185404 on Windows does not properly handle certain small heights in video content, which might allow remote attackers to execute arbitrary code via a crafted AVI file that triggers heap memory corruption.
- Record
CVE-2009-2628- Updated
- 2026-11-02
EUVDEUVD-2009-2622 No score
The VMnc media codec in vmnc.dll in VMware Movie Decoder before 6.5.3 build 185404, VMware Workstation 6.5.x before 6.5.3 build 185404, VMware Player 2.5.x before 2.5.3 build 185404, and VMware ACE 2.5.x before 2.5.3 build 185404 on Windows does not properly handle certain small heights in video content, which might allow remote attackers to execute arbitrary code via a crafted AVI file that triggers heap memory corruption.
- Record
EUVD-2009-2622- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-678r-9fw4-2w76 No score
The VMnc media codec in vmnc.dll in VMware Movie Decoder before 6.5.3 build 185404, VMware...
The VMnc media codec in vmnc.dll in VMware Movie Decoder before 6.5.3 build 185404, VMware Workstation 6.5.x before 6.5.3 build 185404, VMware Player 2.5.x before 2.5.3 build 185404, and VMware ACE 2.5.x before 2.5.3 build 185404 on Windows does not properly handle certain small heights in video content, which might allow remote attackers to execute arbitrary code via a crafted AVI file that triggers heap memory corruption.
- Record
GHSA-678r-9fw4-2w76- Weakness
- CWE-94
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-2628 is a high vulnerability (CVSS 9.3) in Vmware Ace, published September 8, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.57%, the 92nd percentile. No source names a fixed version.
References
lists.vmware.com/pipermail/security-announce/2009/000065.html
securityfocus.com/bid/36290
vupen.com/english/advisories/2009/2553
kb.cert.org/vuls/id/444513
secunia.com/advisories/34938
vmware.com/security/advisories/VMSA-2009-0012.html
nvd.nist.gov/vuln/detail/CVE-2009-2628
github.com/advisories/GHSA-678r-9fw4-2w76