CVE-2024-10573

What it actually does

Out-of-bounds write in libmpg123 during PCM decoding of crafted streams causes heap buffer corruption with potential for arbitrary code execution under high-complexity conditions.

Why it matters to the business

Attackers could gain code execution on systems processing untrusted audio streams, risking full system compromise; low EPSS and high exploit complexity limit immediate risk, though outdated packages on long-supported platforms increase exposure window.

How an attack unfolds

An attacker creates a specially crafted MPEG stream that passes decoder and synth validation, then tricks a user into scanning the stream with a vulnerable mpg123-based application to trigger the heap write and execute payload.

How to fix it

Upgrade openjdk-7 (Ubuntu:14.04:LTS) to 7u85-2.6.1-5ubuntu0.14.04.1 and openjdk-6 (Ubuntu:14.04:LTS) to 6b37-1.13.9-1ubuntu0.14.04.1; rebuild or replace any downstream packages depending on the vulnerable mpg123 library.

How to confirm the fix worked

Confirm package versions match the listed fixed releases, test decoding of known-good streams, and verify no heap corruption occurs with crafted test inputs.

Typical attack path

1. Craft malicious MPEG audio stream validated by MPEG decoder and PCM synth
2. Deliver stream via file download or local media
3. Victim processes stream using affected application
4. Trigger out-of-bounds write to corrupt heap and achieve code execution

How to detect it

Review application logs for mpg123 crashes or buffer-related errors during audio decoding; monitor for unexpected process behavior after media file handling.

What your security team should do

• Apply the exact fixed package versions immediately on all affected Ubuntu 14.04 systems
• Scan for and replace any custom builds or bundled copies of mpg123
• Restrict processing of untrusted local audio files pending updates