CVE-2004-1150

Severity: medium (CVSS 5.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 8.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2004-12-31 · updated 2026-06-16

Description

Stack-based buffer overflow in the in_cdda.dll plugin for Winamp 5.0 through 5.08c allows attackers to execute arbitrary code via a cda:// URL with a long (1) device name or (2) sound track number, as demonstrated with a .m3u or .pls playlist file.

Affected products

Nullsoft Winamp: 5.0, 5.01, 5.02, 5.03, 5.04, 5.05 (+3)

References

http://marc.info/?l=bugtraq&m=110684140108614&w=2
http://secunia.com/advisories/13781
http://www.nsfocus.com/english/homepage/research/0501.htm
http://www.securityfocus.com/bid/12381
http://www.winamp.com/player/version_history.php
https://exchange.xforce.ibmcloud.com/vulnerabilities/18840
http://marc.info/?l=bugtraq&m=110684140108614&w=2
http://secunia.com/advisories/13781
http://www.nsfocus.com/english/homepage/research/0501.htm
http://www.securityfocus.com/bid/12381
http://www.winamp.com/player/version_history.php
https://exchange.xforce.ibmcloud.com/vulnerabilities/18840

Get alerted when CVE-2004-1150 or the next vulnerability affects your stack