CVE-2010-3137

CVE-2010-3137 is an untrusted search path vulnerability affecting Nullsoft Winamp 5.581 and potentially other versions. This flaw allows local users, and possibly remote attackers, to execute arbitrary code and perform DLL hijacking attacks. Attackers can achieve this by placing a malicious wnaspi32.dll file in the same directory as specific audio file types (.669, .aac, .aiff, etc.) that Winamp attempts to open. The vulnerability carries a critical CVSS score of 9.3, indicating a high severity. It is remotely exploitable with medium attack complexity, leading to complete compromise of confidentiality, integrity, and availability. While there is no evidence of active exploitation in the wild, exploit code for DLL hijacking is publicly available on ExploitDB. Despite its severity, there is minimal community discussion or media coverage surrounding this CVE.