Brett Moore has reported a vulnerability in Winamp, which can be exploited by malicious people to compromise a user’s system.

The vulnerability is caused due to a boundary error in the “IN_CDDA.dll” file. This can be exploited in various ways to cause a stack-based buffer overflow e.g. by tricking a user into visiting a malicious web site containing a specially crafted “.m3u” playlist.

Successful exploitation allows execution of arbitrary code.

The vulnerability has been reported in versions 5.05 and 5.06. Prior versions may also be affected.

Solution:
Disassociate “.cda” and “.m3u” extensions from Winamp.