CVE catalog

CVE-2024-10573

mpg123 vulnerability

Severity: High · CVSS 8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published: Oct 30, 2024, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.35% · Oct 25, 2026

An out-of-bounds write flaw was found in mpg123 when handling crafted streams. When decoding PCM, the libmpg123 may write past the end of a heap-located buffer. Consequently, heap corruption may happen, and arbitrary code execution is not discarded. The complexity required to exploit this flaw is considered high as the payload must be validated by the MPEG decoder and the PCM synth before execution. Additionally, to successfully execute the attack, the user must scan through the stream, making web live stream content (such as web radios) a very unlikely attack vector.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	mpg123	sid	`1.33.7-1`	fixed
Debian	mpg123	forky	`1.33.7-1`	fixed
Debian	mpg123	trixie	`1.32.10-1+deb13u1`	fixed
Debian	mpg123	bookworm	`1.31.2-1+deb12u1`	fixed
Debian	mpg123	bookworm-security	`1.31.2-1+deb12u1`	fixed
Ubuntu	mpg123	noble	`1.32.5-1ubuntu1.1`	fixed
Ubuntu	libmpg123-0t64	noble	`1.32.5-1ubuntu1.1`	fixed
Ubuntu	libmpg123-dev	noble	`1.32.5-1ubuntu1.1`	fixed
Ubuntu	libout123-0t64	noble	`1.32.5-1ubuntu1.1`	fixed
Ubuntu	libsyn123-0t64	noble	`1.32.5-1ubuntu1.1`	fixed
Ubuntu	mpg123	noble	`1.31.2-1+deb12u1`	fixed
Alpine	mpg123	3.21	`1.32.8-r0`	fixed
Alpine	mpg123	3.22	`1.32.8-r0`	fixed
Alpine	mpg123	3.23	`1.32.8-r0`	fixed
Alpine	mpg123	3.24	`1.32.8-r0`	fixed
Ubuntu	mpg123	20.04	`1.25.12-1build1`	vulnerable
Ubuntu	mpg123	20.04	`1.25.13-1`	vulnerable
Ubuntu	mpg123	20.04	`1.25.13-1ubuntu0.1`	vulnerable
Ubuntu	mpg123	20.04	`1.25.13-1ubuntu0.2`	fixed
Ubuntu	mpg123	20.04	`1.25.12-1build1`	vulnerable
Ubuntu	mpg123	20.04	`1.25.13-1`	vulnerable
Ubuntu	mpg123	20.04	`1.25.13-1ubuntu0.1`	fixed
Ubuntu	mpg123	22.04	`1.28.2-2`	vulnerable
Ubuntu	mpg123	22.04	`1.29.2-1`	vulnerable
Ubuntu	mpg123	22.04	`1.29.3-1`	vulnerable
Ubuntu	mpg123	22.04	`1.29.3-1build1`	vulnerable
Ubuntu	mpg123	22.04	`1.29.3-1ubuntu0.1`	fixed
Ubuntu	mpg123	24.04	`1.31.3-2`	vulnerable
Ubuntu	mpg123	24.04	`1.32.3-1`	vulnerable
Ubuntu	mpg123	24.04	`1.32.4-1`	vulnerable
Ubuntu	mpg123	24.04	`1.32.5-1`	vulnerable
Ubuntu	mpg123	24.04	`1.32.5-1build2`	vulnerable
Ubuntu	mpg123	24.04	`1.32.5-1ubuntu1`	vulnerable
Ubuntu	mpg123	24.04	`1.32.5-1ubuntu1.1`	fixed
Ubuntu	mpg123	pro	`1.22.2-1`	vulnerable
Ubuntu	mpg123	pro	`1.22.4-1`	vulnerable
Ubuntu	mpg123	pro	`1.22.4-1ubuntu0.1`	vulnerable
Ubuntu	mpg123	pro	`1.22.4-1ubuntu0.1+esm2`	vulnerable
Ubuntu	mpg123	18.04	`1.25.6-1`	vulnerable
Ubuntu	mpg123	18.04	`1.25.7-1`	vulnerable
Ubuntu	mpg123	18.04	`1.25.8-1`	vulnerable
Ubuntu	mpg123	18.04	`1.25.10-1`	vulnerable
Ubuntu	mpg123	20.04	`1.25.12-1build1`	vulnerable
Ubuntu	mpg123	20.04	`1.25.13-1`	vulnerable
Ubuntu	mpg123	20.04	`1.25.13-1ubuntu0.1`	vulnerable
Ubuntu	mpg123	20.04	`1.25.13-1ubuntu0.2`	fixed
Ubuntu	mpg123	22.04	`1.28.2-2`	vulnerable
Ubuntu	mpg123	22.04	`1.29.2-1`	vulnerable
Ubuntu	mpg123	22.04	`1.29.3-1`	vulnerable
Ubuntu	mpg123	22.04	`1.29.3-1build1`	vulnerable
Ubuntu	mpg123	22.04	`1.29.3-1ubuntu0.1`	fixed
Ubuntu	mpg123	24.04	`1.31.3-2`	vulnerable
Ubuntu	mpg123	24.04	`1.32.3-1`	vulnerable
Ubuntu	mpg123	24.04	`1.32.4-1`	vulnerable
Ubuntu	mpg123	24.04	`1.32.5-1`	vulnerable
Ubuntu	mpg123	24.04	`1.32.5-1build2`	vulnerable
Ubuntu	mpg123	24.04	`1.32.5-1ubuntu1`	vulnerable
Ubuntu	mpg123	24.04	`1.32.5-1ubuntu1.1`	fixed
Opensuse	mpg123	tumbleweed	`1.32.9-1.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	mpg123	source	sid	`1.32.8-1`	not yet assigned	Not reported	[1086443]
Debian	mpg123	source	forky	`1.32.8-1`	not yet assigned	Not reported	[1086443]
Debian	mpg123	source	trixie	`1.32.8-1`	not yet assigned	Not reported	[1086443]
Debian	mpg123	source	bookworm	`1.31.2-1+deb12u1`	not yet assigned	Not reported	[1086443]
Ubuntu	mpg123	deb	noble	`1.32.5-1ubuntu1.1`	Not reported	Not reported	Not reported
Ubuntu	libmpg123-0t64	deb	noble	`1.32.5-1ubuntu1.1`	Not reported	Not reported	Not reported
Ubuntu	libmpg123-dev	deb	noble	`1.32.5-1ubuntu1.1`	Not reported	Not reported	Not reported
Ubuntu	libout123-0t64	deb	noble	`1.32.5-1ubuntu1.1`	Not reported	Not reported	Not reported
Ubuntu	libsyn123-0t64	deb	noble	`1.32.5-1ubuntu1.1`	Not reported	Not reported	Not reported
Ubuntu	mpg123	deb	noble	`1.31.2-1+deb12u1`	Not reported	Not reported	Not reported
Alpine	mpg123	apk	3.21	`1.32.8-r0`	Not reported	ALPINE-CVE-2024-10573	Not reported
Alpine	mpg123	apk	3.22	`1.32.8-r0`	Not reported	ALPINE-CVE-2024-10573	Not reported
Alpine	mpg123	apk	3.23	`1.32.8-r0`	Not reported	ALPINE-CVE-2024-10573	Not reported
Alpine	mpg123	apk	3.24	`1.32.8-r0`	Not reported	ALPINE-CVE-2024-10573	Not reported
Ubuntu	mpg123	deb	20.04	`1.25.13-1ubuntu0.2`	Not reported	USN-7092-2	Not reported
Ubuntu	mpg123	deb	20.04	`1.25.13-1ubuntu0.1`	Not reported	USN-7092-1	Not reported
Ubuntu	mpg123	deb	22.04	`1.29.3-1ubuntu0.1`	Not reported	USN-7092-1	Not reported
Ubuntu	mpg123	deb	24.04	`1.32.5-1ubuntu1.1`	Not reported	USN-7092-1	Not reported
Ubuntu	mpg123	deb	20.04	`1.25.13-1ubuntu0.2`	Not reported	UBUNTU-CVE-2024-10573	Not reported
Ubuntu	mpg123	deb	22.04	`1.29.3-1ubuntu0.1`	Not reported	UBUNTU-CVE-2024-10573	Not reported
Ubuntu	mpg123	deb	24.04	`1.32.5-1ubuntu1.1`	Not reported	UBUNTU-CVE-2024-10573	Not reported
Opensuse	mpg123	rpm	tumbleweed	`1.32.9-1.1`	Not reported	OPENSUSE-SU-2024:14454-1	Not reported

[Debian bug #1086443]

OpenFactory catalog packages

[openSUSE Tumbleweed]

[libmpg123-0]Unknown
Source package: [mpg123]
Details (1)
- 1.33.7-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.32.9-1.1
  Version impact unknown
  usn · mpg123 · opensuse · tumbleweed
[libmpg123-0-32bit]Unknown
Source package: [mpg123]
Details (1)
- 1.33.7-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.32.9-1.1
  Version impact unknown
  usn · mpg123 · opensuse · tumbleweed
[libout123-0]Unknown
Source package: [mpg123]
Details (1)
- 1.33.7-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.32.9-1.1
  Version impact unknown
  usn · mpg123 · opensuse · tumbleweed
[libout123-0-32bit]Unknown
Source package: [mpg123]
Details (1)
- 1.33.7-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.32.9-1.1
  Version impact unknown
  usn · mpg123 · opensuse · tumbleweed
[libsyn123-0]Unknown
Source package: [mpg123]
Details (1)
- 1.33.7-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.32.9-1.1
  Version impact unknown
  usn · mpg123 · opensuse · tumbleweed
[libsyn123-0-32bit]Unknown
Source package: [mpg123]
Details (1)
- 1.33.7-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.32.9-1.1
  Version impact unknown
  usn · mpg123 · opensuse · tumbleweed
[mpg123-devel]Unknown
Source package: [mpg123]
Details (1)
- 1.33.7-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.32.9-1.1
  Version impact unknown
  usn · mpg123 · opensuse · tumbleweed
[mpg123-devel-32bit]Unknown
Source package: [mpg123]
Details (1)
- 1.33.7-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.32.9-1.1
  Version impact unknown
  usn · mpg123 · opensuse · tumbleweed
[mpg123-jack]Unknown
Source package: [mpg123]
Details (1)
- 1.33.7-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.32.9-1.1
  Version impact unknown
  usn · mpg123 · opensuse · tumbleweed
[mpg123-jack-32bit]Unknown
Source package: [mpg123]
Details (1)
- 1.33.7-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.32.9-1.1
  Version impact unknown
  usn · mpg123 · opensuse · tumbleweed
[mpg123-openal]Unknown
Source package: [mpg123]
Details (1)
- 1.33.7-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.32.9-1.1
  Version impact unknown
  usn · mpg123 · opensuse · tumbleweed
[mpg123-openal-32bit]Unknown
Source package: [mpg123]
Details (1)
- 1.33.7-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.32.9-1.1
  Version impact unknown
  usn · mpg123 · opensuse · tumbleweed
[mpg123-portaudio]Unknown
Source package: [mpg123]
Details (1)
- 1.33.7-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.32.9-1.1
  Version impact unknown
  usn · mpg123 · opensuse · tumbleweed
[mpg123-portaudio-32bit]Unknown
Source package: [mpg123]
Details (1)
- 1.33.7-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.32.9-1.1
  Version impact unknown
  usn · mpg123 · opensuse · tumbleweed
[mpg123-pulse]Unknown
Source package: [mpg123]
Details (1)
- 1.33.7-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.32.9-1.1
  Version impact unknown
  usn · mpg123 · opensuse · tumbleweed
[mpg123-pulse-32bit]Unknown
Source package: [mpg123]
Details (1)
- 1.33.7-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.32.9-1.1
  Version impact unknown
  usn · mpg123 · opensuse · tumbleweed
[mpg123-sdl]Unknown
Source package: [mpg123]
Details (1)
- 1.33.7-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.32.9-1.1
  Version impact unknown
  usn · mpg123 · opensuse · tumbleweed
[mpg123-sdl-32bit]Unknown
Source package: [mpg123]
Details (1)
- 1.33.7-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.32.9-1.1
  Version impact unknown
  usn · mpg123 · opensuse · tumbleweed

[Debian 12 (Bookworm)]

[libmpg123-0]Fixed
Source package: [mpg123]
Details (4)
- 1.31.2-1+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 1.31.2-1+deb12u1
  usn · mpg123 · debian · bookworm; usn · mpg123 · debian · 12
- 1.31.2-1+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 1.31.2-1+deb12u1
  usn · mpg123 · debian · bookworm; usn · mpg123 · debian · 12
- 1.31.2-1+deb12u1 · amd64 · bookworm-security
  Fixed · Fixed: 1.31.2-1+deb12u1
  usn · mpg123 · debian · bookworm; usn · mpg123 · debian · 12
- 1.31.2-1+deb12u1 · arm64 · bookworm-security
  Fixed · Fixed: 1.31.2-1+deb12u1
  usn · mpg123 · debian · bookworm; usn · mpg123 · debian · 12
[libmpg123-dev]Fixed
Source package: [mpg123]
Details (4)
- 1.31.2-1+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 1.31.2-1+deb12u1
  usn · mpg123 · debian · bookworm; usn · mpg123 · debian · 12
- 1.31.2-1+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 1.31.2-1+deb12u1
  usn · mpg123 · debian · bookworm; usn · mpg123 · debian · 12
- 1.31.2-1+deb12u1 · amd64 · bookworm-security
  Fixed · Fixed: 1.31.2-1+deb12u1
  usn · mpg123 · debian · bookworm; usn · mpg123 · debian · 12
- 1.31.2-1+deb12u1 · arm64 · bookworm-security
  Fixed · Fixed: 1.31.2-1+deb12u1
  usn · mpg123 · debian · bookworm; usn · mpg123 · debian · 12

Next results

Observed: Oct 27, 2026, 1:04:38 AM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]