CVE-2008-5616

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 7.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-12-17 · updated 2026-06-16
Weakness: CWE-119

Description

Stack-based buffer overflow in the demux_open_vqf function in libmpdemux/demux_vqf.c in MPlayer 1.0 rc2 before r28150 allows remote attackers to execute arbitrary code via a malformed TwinVQ file.

Affected products

Mplayer: through 1.0_rc1; 0.90, 0.90_pre, 0.90_rc, 0.90_rc4, 0.91, 0.92 (+13)

References

http://secunia.com/advisories/33136
http://secunia.com/advisories/34845
http://svn.mplayerhq.hu/mplayer/branches/1.0rc2/libmpdemux/demux_vqf.c?r1=24723&r2=28150&pathrev=28150
http://svn.mplayerhq.hu/mplayer/branches/1.0rc2/libmpdemux/demux_vqf.c?view=log&pathrev=28150#rev28150
http://trapkit.de/advisories/TKADV2008-014.txt
http://www.debian.org/security/2009/dsa-1782
http://www.mandriva.com/security/advisories?name=MDVSA-2009:013
http://www.mandriva.com/security/advisories?name=MDVSA-2009:014
http://www.securityfocus.com/archive/1/499214/100/0/threaded
http://www.securityfocus.com/bid/32822
http://secunia.com/advisories/33136
http://secunia.com/advisories/34845

Get alerted when CVE-2008-5616 or the next vulnerability affects your stack