CVE-2009-1301

CVE-2009-1301 describes an integer signedness error in the mpg123 audio player, specifically within its ID3v2 code's store_id3_text function. This flaw allows remote attackers to trigger a denial of service via out-of-bounds memory access and potentially execute arbitrary code by supplying a crafted ID3 tag with a negative encoding value. The vulnerability carries a critical CVSS score of 10.0, indicating a network-based attack with low complexity and complete impact on confidentiality, integrity, and availability. Despite its high severity, there is no evidence of active exploitation, no known public exploit code (Metasploit, Nuclei, ExploitDB), and minimal community discussion or media coverage.