Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2009-2525

Microsoft Windows Media Runtime, as used in DirectShow WMA Voice Codec, Windows Media Audio Voice Decoder, and Audio Compression Manager (ACM), does not properly initialize unspecified functions within compressed audio files, which allows remote attackers to execute arbitrary code via (1) a crafted media file or (2) crafted streaming content, aka "Windows Media Runtime Heap Corruption Vulnerability."

Published

2009-10-14T10:30:01.640

Last Modified

2025-04-09T00:30:58.490

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 9.3 (HIGH)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: COMPLETE
  • Integrity Impact: COMPLETE
  • Availability Impact: COMPLETE
Exploitability Score

8.6

Impact Score

10.0

Weaknesses
  • Type: Primary
    CWE-94
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System microsoft windows_2000 * Yes
Application microsoft windows_media_format_runtime 9.0 Yes
Application microsoft windows_media_player 9 Yes
Application microsoft windows_media_format_runtime 9.0 Yes
Application microsoft windows_media_format_runtime 9.5 Yes
Application microsoft windows_media_format_runtime 11 Yes
Operating System microsoft windows_xp * Yes
Operating System microsoft windows_xp * Yes
Operating System microsoft windows_xp * Yes
Application microsoft windows_media_format_runtime 9.5 Yes
Operating System microsoft windows_server_2003 * Yes
Application microsoft windows_media_format_runtime 11 Yes
Operating System microsoft windows_server_2008 * Yes
Operating System microsoft windows_server_2008 * Yes
Operating System microsoft windows_server_2008 * Yes
Operating System microsoft windows_server_2008 * Yes
Operating System microsoft windows_vista * Yes
Operating System microsoft windows_vista * Yes
Operating System microsoft windows_vista * Yes
Operating System microsoft windows_vista * Yes
References