CVE-2006-0476: nullsoft winamp

EPSS trend

Probability

74.99%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

0.00 pp

From 74.99% on 21-09-2026

21-09-202621-10-2026

EPSS score

74.99%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

5 found

exploit-databaselocalwindowsVerified
Winamp - Playlist UNC Path Computer Name Overflow (Metasploit)
Maturity: weaponized
exploit-databaseremotewindowsVerified
Winamp 5.12 - '.pls' Remote Buffer Overflow (1)
Maturity: weaponized
exploit-databaseremotewindowsVerified
Winamp 5.12 - '.pls' Remote Buffer Overflow (Metasploit)
Maturity: weaponized

Show all 5 exploits

exploit-databaseremotewindowsVerified
Winamp 5.12 - '.pls' Remote Buffer Overflow (Perl) (2)
Maturity: weaponized
MetasploitremoteVerified
Winamp Playlist UNC Path Computer Name Overflow
exploit/windows/browser/winamp_playlist_unc
Maturity: weaponized

References

16 links

securityreason.com/securityalert/398Third Party AdvisoryX Refsource SREASON
exchange.xforce.ibmcloud.com/vulnerabilities/24361VDB EntryX Refsource XF
securityreason.com/securityalert/386Third Party AdvisoryX Refsource SREASON
securitytracker.com/id?1015552VDB EntryX Refsource SECTRACK
www.exploit-db.com/exploits/3422ExploitX Refsource EXPLOIT DB
secunia.com/advisories/18649Third Party AdvisoryX Refsource SECUNIAPatchVendor Advisory
www.heise.de/newsticker/meldung/68981X Refsource MISC
www.vupen.com/english/advisories/2006/0361VDB EntryX Refsource VUPEN
www.securityfocus.com/archive/1/423548/100/0/threadedMailing ListX Refsource BUGTRAQ
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1402VDB EntrySignatureX Refsource OVAL

Show all 16 references

www.winamp.com/player/version_history.phpX Refsource MISC
www.securityfocus.com/archive/1/423436/100/0/threadedMailing ListX Refsource BUGTRAQ
www.securityfocus.com/bid/16410VDB EntryX Refsource BID
www.osvdb.org/22789VDB EntryX Refsource OSVDB
www.us-cert.gov/cas/techalerts/TA06-032A.htmlThird Party AdvisoryX Refsource CERTUS Government Resource
www.kb.cert.org/vuls/id/604745Third Party AdvisoryX Refsource CERT VNUS Government Resource

Related vulnerabilities

CVE-2013-4694nullsoftwinamp17.21%12y ago16-04-2014 22:00Stack-based buffer overflow in gen_jumpex.dll in Winamp before 5.64 Build 3418 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a package with a long Skin directory name. NOTE: a second buffer overflow involving a long GUI Search field to ml_local.dll was also reported. However, since it is only exploitable by the user of the application, this issue would not cross privilege boundaries unless Winamp is running under a highly restricted environment such as a kiosk.CVE-2007-4619debianflac+26.75%19y ago12-10-2007 21:00Multiple integer overflows in Free Lossless Audio Codec (FLAC) libFLAC before 1.2.1, as used in Winamp before 5.5 and other products, allow user-assisted remote attackers to execute arbitrary code via a malformed FLAC file that triggers improper memory allocation, resulting in a heap-based buffer overflow.CVE-2014-3442nullsoftwinamp2.79%12y ago23-05-2014 14:00Winamp 5.666 and earlier allows remote attackers to cause a denial of service (memory corruption and crash) via a malformed .FLV file, related to f263.w5s.CVE-2005-2310nullsoftwinamp13.13%21y ago19-07-2005 04:00Buffer overflow in Winamp 5.03a, 5.09 and 5.091, and other versions before 5.094, allows remote attackers to execute arbitrary code via an MP3 file with a long ID3v2 tag such as (1) ARTIST or (2) TITLE.CVE-2008-3441nullsoftwinamp2.53%18y ago01-08-2008 14:00Nullsoft Winamp before 5.24 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning.CVE-2008-3567nullsoftwinamp1.88%18y ago10-08-2008 20:00Cross-zone scripting vulnerability in the NowPlaying functionality in NullSoft Winamp before 5.541 allows remote attackers to conduct cross-site scripting (XSS) attacks via an MP3 file with JavaScript in id3 tags.

All vulnerabilities inwinamp

CVE-2006-0476: nullsoft winamp

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References