Winamp 2.91 uses a default plugin called IN_MIDI.DLL used to play MIDI files. Version 3.01 and below for this plugin lets an attacker execute code by simply setting the “Track data size” value of a MIDI file to 0xffffffff.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/31601/winamp-midi-adv.txt
Source: https://packetstormsecurity.com/files/31601/winamp-midi-adv.txt.html