Read the docs
TI-2009-01706 Aliases CVE-2009-1791GHSA-5xq8-86qp-x5q2

Heap-based buffer overflow in aiff_read_header in libsndfile 1.0.15 through 1.0.19, as…

Priority MEDIUM 49CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Code execution
Confidentiality · integrity · availability
Complete · Complete · Complete
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.

Summary

Heap-based buffer overflow in aiff_read_header in libsndfile 1.0.15 through 1.0.19, as used in Winamp 5.552 and possibly other media programs, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via an AIFF file with an invalid header value.

Why it matters now

EPSS 0.06533 93rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:mega-nerd:libsndfile:1.0.15:*:*:*:*:*:*:*1.0.15VulnerableMega-nerd
cpe:2.3:a:mega-nerd:libsndfile:1.0.16:*:*:*:*:*:*:*1.0.16VulnerableMega-nerd
cpe:2.3:a:mega-nerd:libsndfile:1.0.17:*:*:*:*:*:*:*1.0.17VulnerableMega-nerd
cpe:2.3:a:mega-nerd:libsndfile:1.0.18:*:*:*:*:*:*:*1.0.18VulnerableMega-nerd
cpe:2.3:a:mega-nerd:libsndfile:1.0.19:*:*:*:*:*:*:*1.0.19VulnerableMega-nerd
cpe:2.3:a:nullsoft:winamp:5.5:*:*:*:*:*:*:*5.5VulnerableNullsoft
cpe:2.3:a:nullsoft:winamp:5.51:*:*:*:*:*:*:*5.51VulnerableNullsoft
cpe:2.3:a:nullsoft:winamp:5.52:*:*:*:*:*:*:*5.52VulnerableNullsoft
cpe:2.3:a:nullsoft:winamp:5.54:*:*:*:*:*:*:*5.54VulnerableNullsoft
cpe:2.3:a:nullsoft:winamp:5.55:*:*:*:*:*:*:*5.55VulnerableNullsoft
  • cpe:2.3:a:mega-nerd:libsndfile:1.0.15:*:*:*:*:*:*:* Versions 1.0.15 Vulnerable ·Mega-nerd
  • cpe:2.3:a:mega-nerd:libsndfile:1.0.16:*:*:*:*:*:*:* Versions 1.0.16 Vulnerable ·Mega-nerd
  • cpe:2.3:a:mega-nerd:libsndfile:1.0.17:*:*:*:*:*:*:* Versions 1.0.17 Vulnerable ·Mega-nerd
  • cpe:2.3:a:mega-nerd:libsndfile:1.0.18:*:*:*:*:*:*:* Versions 1.0.18 Vulnerable ·Mega-nerd
  • cpe:2.3:a:mega-nerd:libsndfile:1.0.19:*:*:*:*:*:*:* Versions 1.0.19 Vulnerable ·Mega-nerd
  • cpe:2.3:a:nullsoft:winamp:5.5:*:*:*:*:*:*:* Versions 5.5 Vulnerable ·Nullsoft
  • cpe:2.3:a:nullsoft:winamp:5.51:*:*:*:*:*:*:* Versions 5.51 Vulnerable ·Nullsoft
  • cpe:2.3:a:nullsoft:winamp:5.52:*:*:*:*:*:*:* Versions 5.52 Vulnerable ·Nullsoft
  • cpe:2.3:a:nullsoft:winamp:5.54:*:*:*:*:*:*:* Versions 5.54 Vulnerable ·Nullsoft
  • cpe:2.3:a:nullsoft:winamp:5.55:*:*:*:*:*:*:* Versions 5.55 Vulnerable ·Nullsoft
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:nullsoft:winamp:5.541:*:*:*:*:*:*:*5.541VulnerableNullsoft
cpe:2.3:a:nullsoft:winamp:5.552:*:*:*:*:*:*:*5.552VulnerableNullsoft
  • cpe:2.3:a:nullsoft:winamp:5.541:*:*:*:*:*:*:* Versions 5.541 Vulnerable ·Nullsoft
  • cpe:2.3:a:nullsoft:winamp:5.552:*:*:*:*:*:*:* Versions 5.552 Vulnerable ·Nullsoft

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2009-1791
  2. 2026-10-03 Alias added: GHSA-5xq8-86qp-x5q2

References

Patch 3

Advisory 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences