CVE-2008-0065: Winamp in_mp3.dll stack buffer overflow via Ultravox metadata tags

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCVSS 2.0 base score of 10 with network vector, no authentication, and full confidentiality, integrity, and availability impact, tempered by the age of the product and lack of confirmed in-the-wild exploitation.

What it is

Winamp 5.21, 5.5, and 5.51 contain multiple stack-based buffer overflows in in_mp3.dll triggered by long artist or name tags in Ultravox streaming metadata, related to stream title construction. A remote attacker can crash the player or execute arbitrary code in the context of the user running Winamp.

Impact

Successful exploitation allows remote code execution with the privileges of the Winamp process, giving an attacker full control of the affected host. At minimum, a crafted stream can crash the player.

Attack surface

Reached over the network via a malicious or compromised Ultravox stream whose metadata carries an oversized artist or name tag; no authentication is required, but the victim must open or connect to the stream, so some user interaction is implied.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged in the record, but EPSS is high (0.61275, 99.1st percentile), indicating elevated likelihood of exploitation activity.

What to do

• Upgrade Winamp to a version later than 5.51, which is the last affected release named in the record.
• If upgrade is not possible, disable or remove the in_mp3.dll MP3/streaming input plug-in so Ultravox metadata is not parsed.
• Block or restrict outbound and inbound Ultravox streaming traffic at the network perimeter where feasible.
• Warn users not to open untrusted stream URLs or media links from unknown sources.

Detection

• Monitor for Winamp process crashes or abnormal termination correlated with streaming media playback.
• Inspect network traffic for Ultravox streams containing unusually long artist or name metadata fields.
• Hunt for child processes spawned by winamp.exe, which would indicate code execution rather than a simple crash.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.