CVE-2017-6831 describes a heap-based buffer overflow in the decodeBlockWAVE function within the Audio File Library (audiofile) versions 0.2.7 through 0.3.6. This vulnerability allows an unauthenticated, remote attacker to cause a denial of service (application crash) by tricking a user into opening a specially crafted audio file. With a CVSS score of 5.5 (Medium), the attack requires user interaction and local access, but can lead to high availability impact. There is currently no known active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
0.2.7CPE matchmatch criteria | cpe:2.3:a:audiofile:audiofile:0.2.7:*:*:*:*:*:*:* | ||
0.3.0CPE matchmatch criteria | cpe:2.3:a:audiofile:audiofile:0.3.0:*:*:*:*:*:*:* | ||
0.3.1CPE matchmatch criteria | cpe:2.3:a:audiofile:audiofile:0.3.1:*:*:*:*:*:*:* | ||
0.3.2CPE matchmatch criteria | cpe:2.3:a:audiofile:audiofile:0.3.2:*:*:*:*:*:*:* | ||
0.3.3CPE matchmatch criteria | cpe:2.3:a:audiofile:audiofile:0.3.3:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Heap-based buffer overflow in the decodeBlockWAVE function in IMA.cpp in Audio File Library (aka audiofile) 0.3.6, 0.3.5, 0.3.4, 0.3.3, 0.3.2, 0.3.1, 0.3.0 and 0.2.7 allows remote attackers to cause a denial of service (crash) via a crafted file.
Mar 14, 2017audiofile: Heap-based buffer overflow in IMA::decodeBlockWAVE
Feb 26, 2017