Winamp MAKI Parsing Vulnerability Details
Summary: Cisco Talos found an integer overflow in Winamp 5.55's MAKI script parsing module, where gen_ff.dll reads a two-byte string size, sign-extends it, and overflows a 0x10008 stack buffer when the size is 0x8000 or greater. AOL released Winamp 5.552 with the fix on 2009-04-11, and Sourcefire shipped detection (gid:3 sid:15433) on 2009-03-31.
What's compelling: The exploit path is a modern skin downloaded from a webpage, so a crafted .maki file can overwrite EIP with attacker-controlled bytes and run code as the current user - meaning a media player's skin format was a direct route to code execution on any machine running Winamp 5.55 or earlier.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026