{"id":"CVE-2009-4356","aliases":["EUVD-2009-4324","GHSA-jm9f-94hg-cq9c"],"status":"published","title":"Multiple integer overflows in the jpeg.w5s and png.w5s filters in Winamp before 5.57 allow remote...","description":"Multiple integer overflows in the jpeg.w5s and png.w5s filters in Winamp before 5.57 allow remote attackers to execute arbitrary code via malformed (1) JPEG or (2) PNG data in an MP3 file.","severity":{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.04973,"percentile":0.92255,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-189"],"published":"2009-12-18T19:00:00Z","modified":"2026-06-16T23:13:30Z","products":[{"vendor":"nullsoft","product":"winamp"}],"references":[{"url":"http://www.securityfocus.com/archive/1/508532/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://forums.winamp.com/showthread.php?threadid=315355","tags":["x_refsource_CONFIRM","x_transferred","Patch"]},{"url":"http://www.vupen.com/english/advisories/2009/3576","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Vendor Advisory"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15743","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred"]},{"url":"http://www.vupen.com/exploits/Winamp_png_w5s_PNG_Data_Processing_Integer_Overflow_PoC_3576274.php","tags":["x_refsource_MISC","x_transferred","Exploit","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/37387","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-4356"},{"url":"https://github.com/advisories/GHSA-jm9f-94hg-cq9c"}],"sources":{"cve":[{"id":"CVE-2009-4356","description":"Multiple integer overflows in the jpeg.w5s and png.w5s filters in Winamp before 5.57 allow remote attackers to execute arbitrary code via malformed (1) JPEG or (2) PNG data in an MP3 file.","status":"published","published":"2009-12-18T19:00:00Z","modified":"2024-08-07T07:01:20.408Z","updated_at":"2026-11-02T14:33:24.451733Z"}],"euvd":[{"id":"EUVD-2009-4324","description":"Multiple integer overflows in the jpeg.w5s and png.w5s filters in Winamp before 5.57 allow remote attackers to execute arbitrary code via malformed (1) JPEG or (2) PNG data in an MP3 file.","status":"published","published":"2009-12-18T19:00:00Z","modified":"2024-08-07T07:01:20Z","updated_at":"2026-11-03T01:39:10.681785Z"}],"ghsa":[{"id":"GHSA-jm9f-94hg-cq9c","title":"Multiple integer overflows in the jpeg.w5s and png.w5s filters in Winamp before 5.57 allow remote...","description":"Multiple integer overflows in the jpeg.w5s and png.w5s filters in Winamp before 5.57 allow remote attackers to execute arbitrary code via malformed (1) JPEG or (2) PNG data in an MP3 file.","status":"published","published":"2022-05-02T03:54:00Z","modified":"2023-01-31T05:08:40Z","updated_at":"2026-11-02T14:49:26.159542Z"}],"nvd":[{"id":"CVE-2009-4356","description":"Multiple integer overflows in the jpeg.w5s and png.w5s filters in Winamp before 5.57 allow remote attackers to execute arbitrary code via malformed (1) JPEG or (2) PNG data in an MP3 file.","status":"published","published":"2009-12-18T19:30:00.577Z","modified":"2026-06-16T23:13:30.777Z","cvss":[{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-189"],"updated_at":"2026-11-02T14:01:37.939838Z"}]}}