CVE-2020-22219

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-08-22 · updated 2026-06-17
Weakness: CWE-120

Description

Buffer Overflow vulnerability in function bitwriter_grow_ in flac before 1.4.0 allows remote attackers to run arbitrary code via crafted input to the encoder.

Affected products

Flac Project Flac: before 1.4.0 — fixed in 1.4.0

How to fix

Upgrade to a fixed version: Flac Project Flac 1.4.0. Check the vendor advisory for mitigations.

References

https://github.com/xiph/flac/issues/215
https://lists.debian.org/debian-lts-announce/2023/09/msg00028.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZD2AJTU4PCJQP7HPTS2L2ELJWBASCRGD/
https://www.debian.org/security/2023/dsa-5500
https://github.com/xiph/flac/issues/215
https://lists.debian.org/debian-lts-announce/2023/09/msg00028.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZD2AJTU4PCJQP7HPTS2L2ELJWBASCRGD/
https://www.debian.org/security/2023/dsa-5500

Get alerted when CVE-2020-22219 or the next vulnerability affects your stack