CVE-2023-49356

What it actually does

Stack buffer overflow in WriteMP3GainAPETag at apetag.c:592 that corrupts memory and triggers a denial of service when processing crafted input.

Why it matters to the business

Attackers can remotely crash MP3Gain instances, causing loss of audio processing availability and requiring restarts or manual intervention.

How an attack unfolds

An attacker crafts a malicious MP3 file containing oversized APE tag data, supplies it to MP3Gain, and triggers the vulnerable function to overflow the stack and crash the process.

How to fix it

Upgrade eclipse/openj9 (GIT) to commit b0699311c7d9341f3d0ebf9a7a4b5546a7ca7004 or apply an equivalent patch that corrects the buffer handling in apetag.c.

How to confirm the fix worked

Rebuild or redeploy with the fixed commit, then confirm the vulnerable code path at apetag.c:592 is no longer present and test with known crashing inputs.

Typical attack path

1. Identify a reachable MP3Gain instance or command-line invocation
2. Prepare a malformed MP3 file with oversized APE tag metadata
3. Invoke MP3Gain on the crafted file to reach WriteMP3GainAPETag
4. Trigger the stack overflow leading to immediate process termination

How to detect it

Review process crash logs and core dumps for abnormal termination inside WriteMP3GainAPETag or apetag.c when processing untrusted MP3 files.

What your security team should do

• Apply the referenced commit or newer release immediately on all MP3Gain deployments
• Scan build pipelines and dependency manifests for the affected version
• Add MP3Gain to the list of tools that require input sanitization review