CVE-2009-2525: Code Injection
Microsoft Windows Media Runtime, as used in DirectShow WMA Voice Codec, Windows Media Audio Voice Decoder, and Audio Compression Manager (ACM), does not properly initialize unspecified functions within compressed audio files, which allows remote attackers to execute arbitrary code via (1) a crafted media file or (2) crafted streaming content, aka "Windows Media Runtime Heap Corruption Vulnerability."
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2009-2525?
CVE-2009-2525 is rated as critical, allowing remote attackers to execute arbitrary code on vulnerable systems.
How do I fix CVE-2009-2525?
To fix CVE-2009-2525, update to the latest patches provided by Microsoft for the affected Windows versions.
Which versions of Windows are affected by CVE-2009-2525?
CVE-2009-2525 affects Microsoft Windows 2000, Windows XP, Windows Vista, Windows Server 2003, and Windows Server 2008.
What kind of attacks can exploit CVE-2009-2525?
CVE-2009-2525 can be exploited by attackers using crafted audio files to execute arbitrary code on target systems.
Is there a workaround for CVE-2009-2525?
Currently, Microsoft recommends applying security updates as the best protection against CVE-2009-2525.