CVE-2017-11126

What it actually does

Buffer over-read in the III_i_stereo function of libmpg123 when processing a crafted MP3 file in the block_type != 2 code path, resulting in application crash.

Why it matters to the business

Media processing workloads or applications handling untrusted audio files can experience unexpected crashes and service disruption; the issue is nearly a decade old with negligible exploitation probability.

How an attack unfolds

An attacker creates a specially crafted MP3 file that triggers the mishandled block_type != 2 case inside III_i_stereo and delivers it to a victim who opens the file with a vulnerable mpg123 build, causing an immediate crash.

How to fix it

Upgrade mpg123 to a version newer than 1.25.1; the listed Kubernetes images already ship non-vulnerable builds (fixed in version 0).

How to confirm the fix worked

Confirm mpg123 version is greater than 1.25.1 and test playback of known trigger files; verify container image layers do not contain vulnerable libmpg123 binaries.

Typical attack path

1. Craft malicious MP3 audio file exploiting the block_type != 2 path in layer3.c
2. Deliver the file via email, download link, or media repository
3. Victim opens or plays the file with mpg123 <= 1.25.1
4. Application crashes due to buffer over-read

How to detect it

Review application crash logs for mpg123 or libmpg123 processes; search for unexpected terminations while handling MP3 files; no widespread exploitation has been observed since publication.

What your security team should do

• Ensure all builds use mpg123 > 1.25.1 or remove the library if audio decoding is unnecessary
• Block or sandbox untrusted audio file processing where possible
• Monitor EPSS and KEV status for any future change in exploit availability