Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.7

Aubio 0.4.6: Malicious Audio Files Can Crash Application

CVE-2018-14523 · published 8 years ago
Summary

The aubio audio analysis library is vulnerable to a crash when processing specially crafted audio files. This could potentially allow an attacker to disrupt your application's functionality. You should update to the latest version of aubio to mitigate this risk.

What to do
  • Update paul brossier aubio to version 0.4.7.
Affected software
Ecosystem VendorProductAffected versions
pip paul brossier aubio < 0.4.7
Fix: upgrade to 0.4.7
– aubio aubio 0.4.6
cpe:2.3:a:aubio:aubio:0.4.6:*:*:*:*:*:*:*
– opensuse leap 15.0
42.3
cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*
– suse linux_enterprise 15.0
cpe:2.3:o:suse:linux_enterprise:15.0:*:*:*:*:*:*:*
Original advisory text
An issue was discovered in aubio 0.4.6. A buffer over-read can occur in new_aubio_pitchyinfft in pitch/pitchyinfft.c, as demonstrated by aubionotes.
An issue was discovered in aubio 0.4.6. A buffer over-read can occur in new_aubio_pitchyinfft in pitch/pitchyinfft.c, as demonstrated by aubionotes.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
8.7 High
Exploitation
2% chance of attack within 30 days
Type
CWE-125Out-of-bounds Read
Timeline
Published23 Jul 2018
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-3x58-8qmv-wqw5 · GHSA
CVE-2018-14523 · NVD
Track software like this
Free during beta