What’s Vulnerable › Vulnerabilities

CVE-2017-11126

• Severity: medium (CVSS 5.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-07-10 · updated 2026-06-17
• Weakness: CWE-125

Description

The III_i_stereo function in libmpg123/layer3.c in mpg123 through 1.25.1 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted audio file that is mishandled in the code for the "block_type != 2" case, a similar issue to CVE-2017-9870.

Affected products

• Mpg123: through 1.25.1

References

• http://openwall.com/lists/oss-security/2017/07/10/4
• https://blogs.gentoo.org/ago/2017/07/03/mpg123-global-buffer-overflow-in-iii_i_stereo-layer3-c/
• http://openwall.com/lists/oss-security/2017/07/10/4
• https://blogs.gentoo.org/ago/2017/07/03/mpg123-global-buffer-overflow-in-iii_i_stereo-layer3-c/

Get alerted when CVE-2017-11126 or the next vulnerability affects your stack