CVE-2009-0323: W3C Amaya stack buffer overflows via crafted HTML/XML input

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityRemote, unauthenticated code execution with public exploit code and very high EPSS, though it requires user interaction and affects an old, likely uncommon browser.

What it is

W3C Amaya 10.0 and 11.0 contain multiple stack-based buffer overflows in its HTML/XML parsing code, including the EndOfXmlAttributeValue and ProcessStartGI functions and the msgBuffer variable in html2thot.c and xml2thot.c. A remote attacker can trigger them with a crafted document containing an oversized type parameter in an input tag or a malformed start tag, leading to memory corruption. The flaw matters because it is remotely reachable and can result in arbitrary code execution in the context of the user running the browser.

Impact

An attacker who gets a victim to open a malicious page or document can corrupt the stack and potentially execute arbitrary code with the victim's privileges. A crash or denial of service is also possible.

Attack surface

The vector is network-reachable with no authentication and no privileges required (AV:N/AC:L/Au:N). Exploitation requires the victim to load attacker-controlled HTML or XML content in Amaya, so some form of user interaction is needed despite the description not stating it explicitly.

Exploitation

No CISA KEV listing, but EPSS is 0.6249 (99th percentile) and references are tagged Exploit, with public exploit code on Exploit-DB and Core Security advisories, indicating public exploitation techniques exist.

What to do

• Upgrade to a patched or current Amaya release, or retire Amaya if no supported fix exists.
• Restrict or block untrusted HTML/XML files from being opened in Amaya, and avoid using it as a default handler for web content.
• Run Amaya with least privilege and in a sandbox or isolated environment to limit the impact of code execution.
• Apply OS-level exploit mitigations (ASLR, DEP) and keep the host patched to raise exploitation difficulty.

Detection

• Monitor for Amaya process crashes or abnormal termination when opening HTML/XML files.
• Inspect network or file-transfer logs for HTML/XML content containing unusually long type attributes in input tags or malformed start tags.
• Watch for child processes spawned by Amaya, which would indicate successful code execution.
• Use endpoint detection to flag stack corruption or exploit-like behavior in the Amaya process.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.