Description

An out-of-bounds write flaw was found in mpg123 when handling crafted streams. When decoding PCM, the libmpg123 may write past the end of a heap-located buffer. Consequently, heap corruption may happen, and arbitrary code execution is not discarded. The complexity required to exploit this flaw is considered high as the payload must be validated by the MPEG decoder and the PCM synth before execution. Additionally, to successfully execute the attack, the user must scan through the stream, making web live stream content (such as web radios) a very unlikely attack vector.

Classification

CVE ID: CVE-2024-10573

Affected Products

Vendor: Red Hat

Product: Red Hat Enterprise Linux 7

Exploit Prediction Scoring System (EPSS)

EPSS Score: 0.05% (probability of being exploited)

EPSS Percentile: 17.81% (scored less or equal to compared to others)

EPSS Date: 2025-02-03 (when was this score calculated)

References

https://access.redhat.com/security/cve/CVE-2024-10573
https://bugzilla.redhat.com/show_bug.cgi?id=2322980
https://mpg123.org/cgi-bin/news.cgi#2024-10-26

Timeline