>Most of them still run

specifically, how are those audio files bought from the M$ mu$ic store when they pulled the plug on the licensing server for their DRM?

your claim of still running on modern Windows would be impressive if it is actually true, but saying to use a completely different OS is not something the vast majority of people not typically reading HN are going to do.

I mean, I'm still running Paint Shop Pro 5 and Winamp on Windows 11 like I'm still in the late 90s.

Windows and Microsoft are the legendary backwards compatibility outlier in the software industry where essentially everyone else moves fast and breaks shit.

Oof, Winamp? Check this out: https://www.cvedetails.com/cve/CVE-2008-0065/

Why dafuq would I care about a bug related to a streaming service I've never even heard of when all I do is play locally stored music files?

Incidentally, I still have not come across a suitable replacement for Winamp all these years later. They all have crappy UIs or bring features that I do not want and get in my way.

The best replacement for Winamp is… also Winamp! https://getwacup.com/

weird.. why isn't this copyright infringing? wacup seems to be using 'fair use'..

Fair enough. If you're only playing local files that were obtained from a trustworthy source then you wouldn't be affected.

With a complete RCE like that though, I would definitely not advise playing music downloaded from peer-to-peer networks. While I'm not familiar with the exact requirements to exploit the vulnerability, I would err on the side of caution and assume that music files can be crafted that contain malicious metadata which can achieve similar results without actually being connected to the streaming service.

The details are all right there: It's a vulnerability with the in_mp3.dll plugin (it's the decoder for playing MP3s), specifically with insufficient checks against malformed name and artist tags (probably ID3 tags?).

It's fixed in Winamp v5.52 and above, and the version I use is v5.531 so I'm not affected as it turns out.

I'm sure there are other bugs that I'm affected by, but again: Not really concerned about it.

Yeah, to clarify, the part I wasn't sure about is if it was required to somehow integrate your local Winamp installation with the streaming service, or if it could be exploited simply by playing a downloaded music file. It sounds like it could indeed be exploited without being connected to the service.