CVE-2017-8419

LAME through 3.99.5 relies on the signed integer data type for values in a
WAV or AIFF header, which allows remote attackers to cause a denial of
service (stack-based buffer overflow or heap-based buffer overflow) or
possibly have unspecified other impact via a crafted file, as demonstrated
by mishandling of num_channels.

Bugs

• <https://sourceforge.net/p/lame/bugs/458/&gt;