https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2017-12839.htmlhttps://patchthecve.com/cve/CVE-2017-12839.htmlWed, 17 Jun 2026 01:04:00 +0000HIGH 8.3: A heap-based buffer over-read in the getbits function in src/libmpg123/getbits.h in mpg123 through 1.25.5 allows remote attackers to cause a possible denial-of-service (out-of-bounds read) or possibly have unspecified other impact via a crafted mp3 file.https://patchthecve.com/cve/CVE-2014-9497.htmlhttps://patchthecve.com/cve/CVE-2014-9497.htmlWed, 17 Jun 2026 00:18:28 +0000HIGH 7.5: Buffer overflow in mpg123 before 1.18.0.https://patchthecve.com/cve/CVE-2017-12797.htmlhttps://patchthecve.com/cve/CVE-2017-12797.htmlWed, 17 Jun 2026 01:03:57 +0000MEDIUM 5.5: Integer overflow in the INT123_parse_new_id3 function in the ID3 parser in mpg123 before 1.25.5 on 32-bit platforms allows remote attackers to cause a denial of service via a crafted file, which triggers a heap-based buffer overflow.https://patchthecve.com/cve/CVE-2017-9545.htmlhttps://patchthecve.com/cve/CVE-2017-9545.htmlWed, 17 Jun 2026 01:28:20 +0000MEDIUM 5.5: The next_text function in src/libmpg123/id3.c in mpg123 1.24.0 allows remote attackers to cause a denial of service (buffer over-read) via a crafted mp3 file.https://patchthecve.com/cve/CVE-2017-11126.htmlhttps://patchthecve.com/cve/CVE-2017-11126.htmlWed, 17 Jun 2026 01:01:16 +0000MEDIUM 5.5: The III_i_stereo function in libmpg123/layer3.c in mpg123 through 1.25.1 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted audio file that is mishandled in the code for the "block_type != 2" case, a similar issue to CVE-2017-9870.https://patchthecve.com/cve/CVE-2017-10683.htmlhttps://patchthecve.com/cve/CVE-2017-10683.htmlWed, 17 Jun 2026 01:00:32 +0000HIGH 7.5: In mpg123 1.25.0, there is a heap-based buffer over-read in the convert_latin1 function in libmpg123/id3.c. A crafted input will lead to a remote denial of service attack.