UBUNTU-CVE-2026-75904

libmodplug through 0.8.9.1 contains an out-of-bounds read in patsmplooped in src/loadpat.cpp. The function validates only the upper bound of its sample index against MAXSMP and then subtracts one before indexing the 191-byte static array patloops, so an index of zero reads patloops-1, one byte...

CVE-2026-51273

DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

EUVD-2026-49863

schreibfaul1 ESP32-audioI2S 3.4.5 is vulnerable to Buffer Overflow. The Audio::openaispeech function in the Audio library manually constructs JSON request bodies and HTTP request headers by directly concatenating externally controllable input and instructions strings without effective length...

CVE-2026-51263

CVE-2026-51263 entry is rejected/not used per the initial description.

PT-2026-65532

In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow vulnerability exists in the ID3 tag parsing function showID3Tag of the embedded audio streaming library. The program reads untrusted long ID3 tag value from malicious audio files and uses unbounded appendf to write formatted strin...

CVE-2026-51274

The CVE-2026-51274 entry relates to the schreibfaul1 ESP32-audioI2S 3.4.5 stack, where the heap-based buffer overflow occurs in the ID3v2 SYLT synchronized lyrics parser in audiolib. Root cause: missing bounds validation on attacker-controlled frame size and improper memory access during lyric pa...

SUSE CVE-2026-56109

The Advanced Linux Sound Architecture ALSA library before 1.2.16.1 contains a double-free vulnerability in parsedef in src/conf.c that allows attackers to corrupt memory by supplying maliciously crafted ALSA configuration text. When parsing nested compound or array configuration blocks, parsedef...

Updated libxmp packages fix security vulnerabilities

CVE-2023-45679: Attempt to free an uninitialized memory pointer in vorbisdeinit CVE-2023-45680: Null pointer dereference in vorbisdeinit CVE-2023-45681: Out of bounds heap buffer write CVE-2023-45676: Multi-byte write heap buffer overflow in startdecoder CVE-2023-45677: Heap buffer out of bounds...

CVE-2019-18796

The BASS Audio Library 2.4.14 under Windows is prone to a BASSStreamCreateFile Denial of Service vulnerability infinite loop via a crafted .mp3 file. This weakness could allow attackers to consume excessive CPU and the application becomes unresponsive...

CVE-2019-18794

The BASS Audio Library 2.4.14 under Windows is prone to a BASSStreamCreateFile Use after Free vulnerability via a crafted .ogg file. An attacker can exploit this to gain access to sensitive information that may aid in further attacks. A failure in exploitation leads to denial of service...

CVE-2019-18795

The BASS Audio Library 2.4.14 under Windows is prone to a BASSStreamCreateFile out of bounds read vulnerability via a crafted .wav file. An attacker can exploit this issues to gain access to sensitive information that may aid in further attacks. A failure in exploitation leads to denial of servic...

EUVD-2019-8500

Malware in sbrugna...

EUVD-2019-8501

Malware in sbrugna...

EUVD-2019-8499

Malware in sbrugna...

CVE-2025-21002

Improper access control in LeAudioService prior to SMR Jul-2025 Release 1 allows local attackers to manipulate broadcasting Auracast...

24-hr-music (1.0.3), 2pg-music (>=1.0.0, <=1.1.2) +151 more potentially affected by CVE-2024-21521 via @discordjs/opus (>=0.1.0, <=0.8.0)

@discordjs/opus NPM version =0.1.0, =1.0.0, =1.1.2, =1.0.0, =1.0.3, =1.0.1, =1.0.0, =0.1.0, =1.0.0, =1.0.0, =1.0.1 and more Source cves: CVE-2024-21521 Source advisory: OSV:GHSA-43WQ-XRCM-3VGR...

24-hr-music (1.0.3), 2pg-music (>=1.0.0, <=1.1.2) +195 more potentially affected by CVE-2024-21521 via @discordjs/opus (>=0.1.0, <=0.9.0)

@discordjs/opus NPM version =0.1.0, =1.0.0, =1.1.2, =1.0.0, =1.0.0, =2.0.0, =1.0.3, =1.0.1, =1.0.0, =0.1.0, =0.1.2 and more Source cves: CVE-2024-21521 Source advisory: SNYK:JS-DISCORDJSOPUS-6370643...

3abn (>=1.0.0, <=2.1.11), @2003scape/rsc-sounds (>=1.0.0, <=1.0.1) +381 more potentially affected by CVE-2024-21526 via speaker (>=0.0.10, <=0.5.5)

speaker NPM version =0.0.10, =1.0.0, =1.0.0, =1.0.0, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =1.0.0, =0.1.0, =1.0.0, =0.1.0, =0.1.5 and more Source cves: CVE-2024-21526 Source advisory: SNYK:JS-SPEAKER-6370676...

CVE-2023-32847

In audio, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS08241940; Issue ID: ALPS08241940...

Fedora: Security Advisory for audiofile (FEDORA-2023-e23e432cb2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...