Underbit maintains a focused set of audio-processing libraries—primarily libmad, libid3tag, and related derivatives—that are widely embedded in media players, streaming applications, and multimedia frameworks across consumer and enterprise platforms. Vulnerabilities affecting the vendor skew toward serious outcomes and frequently acquire public exploit code, concentrated in memory-safety issues endemic to native audio decoders: improper buffer-boundary restrictions, double-free conditions, out-of-bounds reads, and reachable assertions that can trigger denial of service or code execution. Defenders should audit their media handling stack for lingering instances of these libraries and prioritize patching or replacement; live severity and exploitation counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Underbit over time
Signals from CVEs in this vendor scope (6 CVEs).
6 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2017-11552MEDIUM mpg321.c in mpg321 0.3.2-1 does not properly manage memory for use with libmad 0.15.1b, which allows remote attackers to cause a denial of service (memory corruption seen in a cras | Aug 1, 2017 | 6.5 | 34 | NO | YES |
CVE-2018-7263CRITICAL The mad_decoder_run() function in decoder.c in Underbit libmad through 0.15.1b allows remote attackers to cause a denial of service (SIGABRT because of double free or corruption) o | Feb 20, 2018 | 9.8 | 31 | NO | NO |
CVE-2017-8373HIGH The mad_layer_III function in layer3.c in Underbit MAD libmad 0.15.1b allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or pos | May 1, 2017 | 7.8 | 27 | NO | NO |
CVE-2004-2779HIGH id3_utf16_deserialize() in utf16.c in libid3tag through 0.15.1b misparses ID3v2 tags encoded in UTF-16 with an odd number of bytes, triggering an endless loop allocating memory unt | Feb 20, 2018 | 7.5 | 26 | NO | NO |
CVE-2017-8374MEDIUM The mad_bit_skip function in bit.c in Underbit MAD libmad 0.15.1b allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a cra | May 1, 2017 | 5.5 | 22 | NO | NO |
CVE-2017-8372MEDIUM The mad_layer_III function in layer3.c in Underbit MAD libmad 0.15.1b, if NDEBUG is omitted, allows remote attackers to cause a denial of service (assertion failure and application | May 1, 2017 | 4.7 | 20 | NO | NO |
Signals from CVEs in this vendor scope (6 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Underbit.
Media articles that mention a CVE ID that affects a product developed by Underbit — matched by CVE ID, not by vendor name.