CVE-2007-4974

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-09-19 · updated 2026-06-16
Weakness: CWE-119

Description

Heap-based buffer overflow in the flac_buffer_copy function in libsndfile 1.0.17 and earlier might allow remote attackers to execute arbitrary code via a FLAC file with crafted PCM data containing a block with a size that exceeds the previous block size.

Affected products

Mega-Nerd Libsndfile: through 1.0.17; 0.0.8, 0.0.28, 1.0.0, 1.0.0-rc1, 1.0.0-rc6, 1.0.1 (+7)

References

http://lists.opensuse.org/opensuse-security-announce/2008-01/msg00002.html
http://secunia.com/advisories/26921
http://secunia.com/advisories/26932
http://secunia.com/advisories/27018
http://secunia.com/advisories/27071
http://secunia.com/advisories/27100
http://secunia.com/advisories/28265
http://secunia.com/advisories/28412
http://security.gentoo.org/glsa/glsa-200710-04.xml
http://www.debian.org/security/2007/dsa-1442
http://www.mandriva.com/security/advisories?name=MDKSA-2007:191
http://www.securityfocus.com/bid/25758

Get alerted when CVE-2007-4974 or the next vulnerability affects your stack