Heap-based buffer overflow in stream_decoder.c in libFLAC before 1.3.1 allows remote attackers to execute arbitrary code via a crafted .flac file.
CVSS Details
- CVSS 3.1 Base Score: 7.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade flac-develUpgrade flacUpgrade flac-libs | Dec 1, 2016 | Nov 26, 2014 |
| Debian | — | Upgrade flac | Jul 30, 2024 | Nov 26, 2014 |
| Freebsd | — | Upgrade flacUpgrade linux-c6-flac | Dec 10, 2025 | Nov 25, 2014 |
| Oracle Solaris | — | Upgrade codec/flac to version 1.2.1-0.175.2.7.0.2.0 on Solaris 11.2Upgrade consolidation/desktop/desktop-incorporation to version 0.5.11-0.175.3.0.0.28.0 on Solaris 11.3 | May 29, 2017 | Nov 26, 2014 |
| Oracle_linux | — | Upgrade flac-libsUpgrade flac-develUpgrade flac | Oct 16, 2024 | Nov 26, 2014 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Nov 25, 2014 |
| Suse | — | Upgrade libFLAC++6-x86Upgrade flacUpgrade libflac8Upgrade flac-develUpgrade libflac-6Upgrade libFLAC8-x86Upgrade libflac-6-32bitUpgrade libflac8-32bit | Dec 18, 2015 | Nov 26, 2014 |
| Ubuntu | — | Upgrade libflac++6Upgrade libflac8 | Nov 8, 2024 | Nov 26, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub