Description
Stack-based buffer overflow in the String_parse::get_nonspace_quoted function in lib-src/allegro/strparse.cpp in Audacity 1.2.6 and other versions before 1.3.6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a .gro file containing a long string.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | audacity | 1.3.6-1 | — |
| Debian 13 | audacity | 1.3.6-1 | — |
| Debian 12 | audacity | 1.3.6-1 | — |
| Debian 5.0 | audacity | 1.3.5-2+lenny1 | DTSA-192-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 3
- Audacity 1.2.6 - '.gro' Local Buffer Overflow EDB-10322 · local · Dec 5, 2009 · verified
- Audacity 1.2 - '.gro' Universal Buffer Overflow (Egghunter) EDB-9501 · local · Aug 24, 2009 · verified
- Audacity 1.2.6 - '.gro' Local Buffer Overflow (PoC) EDB-7634 · dos · Jan 1, 2009 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- DTSA-192-1 audacity - arbitrary code execution Debian Security (DSA / DLA) · Mar 9, 2026
References
- 7634 exploit
- 51070 vdb-entry
- 33090 vdb-entry
- SUSE-SR:2009:004 vendor-advisory
- http://bugs.gentoo.org/show_bug.cgi?id=253493
- ADV-2009-0008 vdb-entry
- 33356 third-party-advisory
- [audacity-devel] 20090110 Audacity "String_parse::get_nonspace_quoted()" Buffer Overflow mailing-list