https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-19T11:54:13.889807+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2024:11193 ALSA-2024:11193 — Moderate: mpg123 security update 2026-10-19T11:54:13.896786+00:00

Affected: AlmaLinux:8: mpg123, AlmaLinux:8: mpg123-devel, AlmaLinux:8: mpg123-libs, AlmaLinux:8: mpg123-plugins-pulseaudio

The mpg123 packages contain real time MPEG 1.0/2.0/2.5 audio player/decoder for layers 1, 2, and 3 (most commonly MPEG 1.0 layer 3 also known as MP3), as well as re-usable decoding and output libraries.

Security Fix(es):

* mpg123: Buffer overflow when writing decoded PCM samples (CVE-2024-10573)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/bdu:2024-11493 bdu:2024-11493 2026-10-19T11:54:13.896853+00:00 bdu:2024-11493 https://cve.radiocsirt.org/vuln/euvd-2026-261511 EUVD-2026-261511 2026-10-19T11:54:13.896901+00:00 EUVD-2026-261511 https://cve.radiocsirt.org/vuln/fkie_cve-2024-10573 fkie_cve-2024-10573 2026-10-19T11:54:13.896913+00:00

An out-of-bounds write flaw was found in mpg123 when handling crafted streams. When decoding PCM, the libmpg123 may write past the end of a heap-located buffer. Consequently, heap corruption may happen, and arbitrary code execution is not discarded. The complexity required to exploit this flaw is considered high as the payload must be validated by the MPEG decoder and the PCM synth before execution. Additionally, to successfully execute the attack, the user must scan through the stream, making web live stream content (such as web radios) a very unlikely attack vector.

 https://cve.radiocsirt.org/vuln/ghsa-7m7j-pgpw-9g75 GHSA-7m7j-pgpw-9g75 2026-10-19T11:54:13.896937+00:00

An out-of-bounds write flaw was found in mpg123 when handling crafted streams. When decoding PCM, the libmpg123 may write past the end of a heap-located buffer. Consequently, heap corruption may happen, and arbitrary code execution is not discarded. The complexity required to exploit this flaw is considered high as the payload must be validated by the MPEG decoder and the PCM synth before execution. Additionally, to successfully execute the attack, the user must scan through the stream, making web live stream content (such as web radios) a very unlikely attack vector.

 https://cve.radiocsirt.org/vuln/opensuse-su-2024:14454-1 openSUSE-SU-2024:14454-1 — libmpg123-0-1.32.9-1.1 on GA media 2026-10-19T11:54:13.896954+00:00

libmpg123-0-1.32.9-1.1 on GA media

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-10573 UBUNTU-CVE-2024-10573 2026-10-19T11:54:13.896971+00:00

Affected: Ubuntu:Pro:14.04:LTS: mpg123, Ubuntu:Pro:16.04:LTS: mpg123, Ubuntu:18.04:LTS: mpg123, Ubuntu:20.04:LTS: mpg123, Ubuntu:22.04:LTS: mpg123, Ubuntu:24.04:LTS: mpg123

An out-of-bounds write flaw was found in mpg123 when handling crafted streams. When decoding PCM, the libmpg123 may write past the end of a heap-located buffer. Consequently, heap corruption may happen, and arbitrary code execution is not discarded. The complexity required to exploit this flaw is considered high as the payload must be validated by the MPEG decoder and the PCM synth before execution. Additionally, to successfully execute the attack, the user must scan through the stream, making web live stream content (such as web radios) a very unlikely attack vector.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-3710 WID-SEC-W-2024-3710 — Red Hat Enterprise Linux (unbound und mpg123): Mehrere Schwachstellen 2026-10-19T11:54:13.896998+00:00

Ein Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um beliebigen Code auszuführen oder einen Denial-of-Service-Zustand zu erzeugen.