Description
An out-of-bounds write flaw was found in mpg123 when handling crafted streams. When decoding PCM, the libmpg123 may write past the end of a heap-located buffer. Consequently, heap corruption may happen, and arbitrary code execution is not discarded. The complexity required to exploit this flaw is considered high as the payload must be validated by the MPEG decoder and the PCM synth before execution. Additionally, to successfully execute the attack, the user must scan through the stream, making web live stream content (such as web radios) a very unlikely attack vector.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | mpg123 | < 1.32.8 | 1.32.8 |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | mpg123 | 1.32.8-1 | — |
| Debian 13 | mpg123 | 1.32.8-1 | — |
| Debian 12 | mpg123 | 1.31.2-1+deb12u1 | DSA-5811-1 |
| Debian 11 | mpg123 | 1.26.4-1+deb11u1 | DLA-3967-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | mpg123 | 1.32.5-1ubuntu1.1 | USN-7092-1 |
| Ubuntu 22.04 LTS | mpg123 | 1.29.3-1ubuntu0.1 | USN-7092-1 |
| Ubuntu 20.04 LTS | mpg123 | 1.25.13-1ubuntu0.2 | USN-7092-2, USN-7092-1 |
| Ubuntu 18.04 LTS | mpg123 | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | mpg123 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | mpg123 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | mpg123 +3 | 1.32.9-1.el9_5 | RHSA-2024:11242 |
| RHEL 8 | mpg123 +3 | 1.32.9-1.el8_10 | RHSA-2024:11193 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | mpg123 +3 | 1.32.9-1.el9_5 | ALSA-2024:11242 |
| AlmaLinux 8 | mpg123 +3 | 1.32.9-1.el8_10 | ALSA-2024:11193 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | mpg123 | 1.32.9-1.el9_5 | RLSA-2024:11242 |
| Rocky Linux 8 | mpg123 | 1.32.9-1.el8_10 | RLSA-2024:11193 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | mpg123 | 1.32.9-1.1 | openSUSE-SU-2024:14454-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | mpg123 | 1.32.8-r0 | — |
| Alpine v3.23 | mpg123 | 1.32.8-r0 | — |
| Alpine v3.22 | mpg123 | 1.32.8-r0 | — |
| Alpine v3.21 | mpg123 | 1.32.8-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | mpg123 +3 | 1.32.9-1.amzn2 | ALAS2-2025-2997 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | mpg123 +3 | 1.32.9-1.el9_5 | ELSA-2024-11242 |
| Oracle Linux 8 | mpg123 +3 | 1.32.9-1.el8_10 | ELSA-2024-11193 |
Advisories 15
- ALSA-2024:11242 Moderate: mpg123:1.32.9 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:11193 Moderate: mpg123 security update AlmaLinux Security Advisories · Oct 29, 2026
- WID-SEC-2024-3710 Red Hat Enterprise Linux (unbound und mpg123): Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 20, 2026
- RHSA-2024:11242 Red Hat Security Advisory: mpg123:1.32.9 security update Red Hat Security Advisories (RHSA) · Jul 12, 2026
- RHSA-2024:11193 Red Hat Security Advisory: mpg123 security update Red Hat Security Advisories (RHSA) · Jul 12, 2026
- USN-7092-2 mpg123 vulnerability Ubuntu Security Notices (USN) · Apr 27, 2026
- USN-7092-1 mpg123 vulnerability Ubuntu Security Notices (USN) · Apr 27, 2026
- DSA-5811-1 mpg123 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3967-1 mpg123 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RLSA-2024:11242 Moderate: mpg123:1.32.9 security update Rocky Linux Security Advisories · Oct 9, 2025
- ALAS2-2025-2997 Moderate: mpg123 security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Sep 16, 2025
- RLSA-2024:11193 Moderate: mpg123 security update Rocky Linux Security Advisories · May 7, 2025
- openSUSE-SU-2024:14454-1 libmpg123-0-1.32.9-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- ELSA-2024-11242 Moderate: mpg123:1.32.9 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Dec 19, 2024
- ELSA-2024-11193 Moderate: mpg123 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Dec 17, 2024
References
- RHSA-2024:11193 vendor-advisory
- RHSA-2024:11242 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2024-10573 vdb-entry
- RHBZ#2322980 issue-tracking
- https://mpg123.org/cgi-bin/news.cgi#2024-10-26