CVE-2009-4633

CVE-2009-4633 describes a critical heap-based buffer overflow vulnerability in FFmpeg 0.5, specifically within the vorbis_dec.c component. This flaw, caused by an incorrect assignment operator, allows remote attackers to trigger a denial of service and potentially execute arbitrary code through a specially crafted file. With a CVSS score of 10.0, it represents a severe risk, requiring no authentication or complex attack vectors for exploitation, and could lead to complete compromise of confidentiality, integrity, and availability. Despite its high severity, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.