The Nullsoft Modern Skins Support module (gen_ff.dll) in Nullsoft Winamp before 5.552 allows remote attackers to execute arbitrary code via…

1. 2009-05-20 First public exploit (Metasploit exploit/windows/fileformat/winamp_maki_bof)
2. 2009-05-29 Published

36.34% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

• Metasploit exploit/windows/fileformat/winamp_maki_bof Winamp MAKI Buffer Overflow metasploit exploit, normal rank, 2009-05-20
• EDB-21256 Winamp - MAKI Buffer Overflow (Metasploit) local, 2012-09-12
• EDB-8783 Winamp 5.551 - MAKI Parsing Integer Overflow local, 2009-05-26
• EDB-8772 Winamp 5.55 - MAKI script Universal Integer Overflow local, 2009-05-22
• EDB-8770 Winamp 5.55 - MAKI Script Universal Overwrite (SEH) local, 2009-05-22
• EDB-8767 Winamp 5.551 - MAKI Parsing Integer Overflow (PoC) dos, 2009-05-22
• securityfocus.com http://www.securityfocus.com/bid/35052 referenced PoC, tagged "exploit" by a source, unverified

Weakness

• CWE-189 Numeric Errors

• exploit-db.com /exploits/8783

  exploit

• exploit-db.com /exploits/8770

  exploit

• exploit-db.com /exploits/8767

  exploit

• exploit-db.com /exploits/8772

  exploit

• securityfocus.com /bid/35052

  vdb-entry, exploit

• exchange.xforce.ibmcloud.com /vulnerabilities/50664

  vdb-entry

• vrt-sourcefire.blogspot.com /2009/05/winamp-maki-parsing-vulnerability.html
• oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15683

  vdb-entry, signature

• CVE List CVE-2009-1831
• NVD CVE-2009-1831

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.