RCE in Microsoft Media Foundation Sdk
CVE-2009-2498
Microsoft Windows Media Format Runtime 9.0, 9.5, and 11 and Windows Media Services 9.1 and 2008 do not properly parse malformed headers in Advanced Systems Format (ASF) files, which allows remote attackers to execute arbitrary code via a crafted (1) .asf, (2) .wmv, or (3) .wma file, aka "Windows Media Header Parsing Invalid Free Vulnerability."
Vulnerability class: RCE (Remote Code Execution)
EPSS: 0.212 (97.5th percentile) — read the EPSS interpretation.
Affected products
- Microsoft Media_foundation_sdk
- Microsoft Windows_2000
- Microsoft Windows_media_format_runtime — versions 9.0, 9.5, 11
- Microsoft Windows_media_services — versions 9.1, 2008
- Microsoft Windows_server_2003
- Microsoft Windows_server_2008
- Microsoft Windows_vista
- Microsoft Windows_xp
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- secure@microsoft.com (x_refsource_MS, vendor-advisory)
- secure@microsoft.com (US Government Resource, x_refsource_CERT, third-party-advisory)
- secure@microsoft.com (signature, x_refsource_OVAL, vdb-entry)
Frequently asked questions
- What is CVE-2009-2498?
- CVE-2009-2498 is a vulnerability in Microsoft Media Foundation Sdk, classified under Code Injection. Published 2009-09-08.
- Is CVE-2009-2498 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.