Vulnerability record · CVE-2010-0480 · published 14 April 2010
CVE-2010-0480: Windows MPEG Layer-3 Audio Decoder Stack Buffer Overflow
Microsoft · Windows 2000
Multiple stack-based buffer overflows exist in the MPEG Layer-3 audio codecs shipped with several legacy Microsoft Windows versions. A crafted AVI file can corrupt the stack and allow remote code execution in the context of the affected process. The flaw matters because media files are routinely opened by users and processed by applications that rely on the system codec.
Description
Multiple stack-based buffer overflows in the MPEG Layer-3 audio codecs in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allow remote attackers to execute arbitrary code via a crafted AVI file, aka "MPEG Layer-3 Audio Decoder Stack Overflow Vulnerability."
AV:N/AC:M/Au:N/C:C/I:C/A:C
Automated analysis
high priorityCVSS 9.3 and a high EPSS percentile indicate severe impact and elevated exploitation likelihood, but the affected platforms are legacy and no KEV listing or confirmed public exploit is present.
What it is
Multiple stack-based buffer overflows exist in the MPEG Layer-3 audio codecs shipped with several legacy Microsoft Windows versions. A crafted AVI file can corrupt the stack and allow remote code execution in the context of the affected process. The flaw matters because media files are routinely opened by users and processed by applications that rely on the system codec.
Impact
An attacker who gets a victim to open a malicious AVI file can execute arbitrary code with the privileges of the user or application handling the file. That can lead to full compromise of the host, data theft, or use of the machine as a foothold.
Attack surface
Reached remotely by delivering a crafted AVI file, typically through a web page, email attachment, or file share, and requiring the victim to open or preview the file. No authentication is needed, but user interaction is required per the CVSS vector (AV:N/AC:M/Au:N).
Exploitation
The record shows no CISA KEV listing and no reference tags indicating public exploit code, though EPSS is high at 0.679 (99.3rd percentile), suggesting elevated likelihood of exploitation activity.
What to do
- Apply Microsoft security bulletin MS10-026 for the affected Windows versions as the primary fix.
- Upgrade or retire Windows 2000, XP, Server 2003, Vista, and Server 2008 systems that are past end of support.
- Block or restrict untrusted AVI and media file attachments at email and web gateways.
- Disable or unregister the MPEG Layer-3 codec where it is not required for business use.
- Educate users not to open media files from unknown or unsolicited sources.
Detection
- Monitor for processes loading the MPEG Layer-3 codec (l3codecx.ax) and crashing or spawning unexpected child processes.
- Hunt for AVI files with malformed MPEG Layer-3 streams arriving via email, web downloads, or removable media.
- Review endpoint crash and exploit telemetry for stack corruption events in media-handling processes.
- Alert on unusual process creation from media players or codec host processes.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
6 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2010-0480 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2010-0480), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
