CVE-2009-0894: Heap-based buffer overflow in the decoder_create function in the initialization functionality in xvidcore/s...

Heap-based buffer overflow in the decoder_create function in the initialization functionality in xvidcore/src/decoder.c in Xvid before 1.2.2, as used by Windows Media Player and other applications, allows remote attackers to execute arbitrary code via vectors involving the DirectShow (aka DShow) frontend and improper handling of the XVID_ERR_MEMORY return code during processing of a crafted movie file. NOTE: some of these details are obtained from third party information.

UnknownCVSS not scoredNot KEV-listedUpdatedSep 16, 2024, 23:42 UTC (UTC+00:00)

Analyst readout for executives and security teams

Plain-English summary

CVE-2009-0894 is an old Xvid video decoder vulnerability. A malicious movie file could trigger memory corruption and potentially run attacker-controlled code in an application that uses the vulnerable Xvid decoder, including cases involving the DirectShow frontend.

Executive priority

Treat as a focused legacy media-processing risk. Prioritize environments that still process untrusted video files, especially desktops, kiosks, forensic workstations, or file-ingestion systems with old codec stacks.

Technical view

The issue is a heap-based buffer overflow in decoder_create within xvidcore/src/decoder.c before Xvid 1.2.2. The CVE attributes the flaw to improper handling of XVID_ERR_MEMORY during crafted movie processing through DirectShow-related paths. Some details are third-party sourced.

Likely exposure

Exposure is most likely on systems with Xvid before 1.2.2 or applications bundling that decoder. The CVE record does not provide complete CPE data, so product-level exposure needs local inventory confirmation.

Exploitation context

The source bundle does not show CISA KEV listing or active exploitation evidence. The plausible attack path is user or automated processing of a crafted movie file by software using vulnerable Xvid decoding components.

Researcher notes

Key evidence points to decoder_create in xvidcore/src/decoder.c and the 1.80 to 1.81 source change. Because affected product metadata is sparse, confirm embedded library versions before declaring specific applications exposed.

Mitigation direction

Upgrade Xvid or bundled xvidcore components to version 1.2.2 or later.
Check vendor guidance for applications that ship their own Xvid decoder.
Restrict handling of untrusted movie files until vulnerable components are updated.
Remove legacy codec packs or media components that are no longer supported.

Validation and detection

Inventory installed Xvid, codec packs, and media applications using xvidcore.
Verify detected Xvid versions are 1.2.2 or later.
Check whether applications bundle private Xvid copies outside system package managers.
Review email, web, and file workflows that automatically preview movie files.

Prepared: Jun 28, 2026, 10:45 UTC (UTC+00:00)
Confidence: medium
Sources: 7

Public sources used

Based on public source material and reviewed before publication.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup

cve · low confidence lookup

CVE-2009-0894 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup

Vulnerability profileCVE Program record

Severity: Unknown
CVSS: Not scored
Known Exploited: No
Published: Jun 2, 2009, 18:00 UTC (UTC+00:00)

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors

0Timeline events

0ADP providers

6Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

CVE List V5 sourceCVE List V5
http://cvs.xvid.org/cvs/viewvc.cgi/xvidcore/src/decoder.cCVE reference · x_refsource_CONFIRM
35158CVE reference · vdb-entry, x_refsource_BID
http://cvs.xvid.org/cvs/viewvc.cgi/xvidcore/src/decoder.c?r1=1.80&r2=1.81CVE reference · x_refsource_CONFIRM
http://www.xvid.org/News.64.0.html?&cHash=0170b4e439&tx_ttnews%5BbackPid%5D=64&tx_ttnews%5Btt_news%5D=7CVE reference · x_refsource_CONFIRM
https://www.it-isac.org/postings/cyber/alertdetail.php?id=4635&selyear=2009&menutype=menupublicCVE reference · x_refsource_MISC

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus

n/an/an/aListed

Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.