AIKIDO-2024-10420

TL;DR

An out-of-bounds write flaw exists in mpg123 when handling crafted streams. During PCM decoding, the libmpg123 library may write past the end of a heap-allocated buffer, leading to potential heap corruption. This vulnerability could allow arbitrary code execution. The complexity to exploit this flaw is high, as the payload must pass validation through both the MPEG decoder and PCM synthesizer before execution. Additionally, successful exploitation requires the attacker to scan through the stream, which makes web live stream content, such as web radios, an unlikely attack vector. However, if successfully exploited, this vulnerability poses a significant risk to affected systems.