CVE-2004-1187: Heap-based buffer overflow in the pnm_get_chunk function for xine 0.99.2, and other packages such as MPlaye...

Security readout for executives and security teams

This is an old remote code execution issue in xine 0.99.2 and shared PNM handler code used by packages such as MPlayer. A malicious media stream or file with an overly long PNA_TAG value could corrupt heap memory. The source bundle does not show current exploitation or modern affected versions. Exposure is most likely in legacy Linux or media-processing systems still running xine 0.99.2, vulnerable MPlayer builds, or bundled forks of the same pnm.c code. Current exposure cannot be assumed from the bundle. Prioritize only where legacy media players or media ingestion services remain in use. The impact is serious, but the evidence points to a 2004-era codebase and provides no active exploitation signal. Mitigation focus: Inventory xine, MPlayer, and products bundling the vulnerable PNM handler code.; Apply vendor-provided updates or patches referenced by MPlayer, xine, and Mandriva.; Retire unsupported legacy builds that cannot receive vendor fixes..

Prepared

Jun 30, 2026, 01:53 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.