Skip to content
Fencer Vulns
medium 6.7

CVE-2024-10573 json

Mpg123: buffer overflow when writing decoded pcm samples

published 2024-10-31 2 y ago modified 2026-11-05 4 d ago also EUVD-2024-33569

cvss
6.7
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 28%
public exploits
0
none known

Summary

An out-of-bounds write flaw was found in mpg123 when handling crafted streams. When decoding PCM, the libmpg123 may write past the end of a heap-located buffer. Consequently, heap corruption may happen, and arbitrary code execution is not discarded. The complexity required to exploit this flaw is considered high as the payload must be validated by the MPEG decoder and the PCM synth before execution. Additionally, to successfully execute the attack, the user must scan through the stream, making web live stream content (such as web radios) a very unlikely attack vector.

Patch / fix

  • Red Hat Red Hat Enterprise Linux 8 0:1.32.9-1.el8_10
  • Red Hat Red Hat Enterprise Linux 9 0:1.32.9-1.el9_5
  • mpg123 Debian 12 1.31.2-1+deb12u1
  • mpg123 Debian 14, Debian 13 1.32.8-1

debian advisories DEBIAN-CVE-2024-10573

  • mpg123 Ubuntu 20.04 LTS 1.25.13-1ubuntu0.2
  • mpg123 Ubuntu 22.04 LTS 1.29.3-1ubuntu0.1
  • mpg123 Ubuntu 24.04 LTS 1.32.5-1ubuntu1.1

ubuntu advisories UBUNTU-CVE-2024-10573

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • mpg123 RHEL 9 1.32.9-1.el9_5
  • mpg123-libs RHEL 9 1.32.9-1.el9_5
  • mpg123-plugins-pulseaudio RHEL 9 1.32.9-1.el9_5
  • mpg123 RHEL 8 1.32.9-1.el8_10
  • mpg123-libs RHEL 8 1.32.9-1.el8_10
  • mpg123-plugins-pulseaudio RHEL 8 1.32.9-1.el8_10

red hat advisories RHSA-2024:11242RHSA-2024:11193

  • mpg123 openSUSE Tumbleweed 1.32.9-1.1

opensuse advisories openSUSE-SU-2024:14454-1

  • mpg123 AlmaLinux 8 1.32.9-1.el8_10
  • mpg123-libs AlmaLinux 8 1.32.9-1.el8_10
  • mpg123-plugins-pulseaudio AlmaLinux 8 1.32.9-1.el8_10
  • mpg123 AlmaLinux 9 1.32.9-1.el9_5
  • mpg123-libs AlmaLinux 9 1.32.9-1.el9_5
  • mpg123-plugins-pulseaudio AlmaLinux 9 1.32.9-1.el9_5

almalinux advisories ALSA-2024:11193ALSA-2024:11242

  • mpg123 Rocky Linux 8 1.32.9-1.el8_10
  • mpg123 Rocky Linux 9 1.32.9-1.el9_5

rocky linux advisories RLSA-2024:11193RLSA-2024:11242

  • mpg123 Alpine 3.24, Alpine 3.23, Alpine 3.22 +1 more 1.32.8-r0

alpine advisories ALPINE-CVE-2024-10573

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-10573 updated cvss 6.7

mpg123: Buffer overflow when writing decoded PCM samples

  • Red Hat Enterprise Linux 7 mpg123, mpg123-libs, mpg123-plugins-pulseaudio
    affected: workaround, no fix planned “This vulnerability can be mitigated by using the --no-frankenstein option to the mpg123 application.”
  • Red Hat CodeReady Linux Builder (v. 9) mpg123-devel 1.32.9-1.el9_5, mpg123-debuginfo 1.32.9-1.el9_5, mpg123-debugsource 1.32.9-1.el9_5, mpg123-libs-debuginfo 1.32.9-1.el9_5, mpg123-plugins-pulseaudio-debuginfo 1.32.9-1.el9_5
    fixed: vendor fix “This vulnerability can be mitigated by using the --no-frankenstein option to the mpg123 application.” RHSA-2024:11242
  • Red Hat Enterprise Linux AppStream (v. 8) mpg123 1.32.9-1.el8_10, mpg123-libs 1.32.9-1.el8_10, mpg123-plugins-pulseaudio 1.32.9-1.el8_10
    fixed: vendor fix “This vulnerability can be mitigated by using the --no-frankenstein option to the mpg123 application.” RHSA-2024:11193
  • Red Hat Enterprise Linux AppStream (v. 9) mpg123 1.32.9-1.el9_5, mpg123-libs 1.32.9-1.el9_5, mpg123-plugins-pulseaudio 1.32.9-1.el9_5
    fixed: vendor fix “This vulnerability can be mitigated by using the --no-frankenstein option to the mpg123 application.” RHSA-2024:11242
  • Red Hat Enterprise Linux CRB (v. 8) mpg123-devel 1.32.9-1.el8_10, mpg123-debuginfo 1.32.9-1.el8_10, mpg123-debugsource 1.32.9-1.el8_10, mpg123-libs-debuginfo 1.32.9-1.el8_10, mpg123-plugins-pulseaudio-debuginfo 1.32.9-1.el8_10
    fixed: vendor fix “This vulnerability can be mitigated by using the --no-frankenstein option to the mpg123 application.” RHSA-2024:11193

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 y ago

Exploit prediction

0.35% chance of exploitation in the next 30 days, higher than 28% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Affected products

  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 7

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.