Security summary: 19 known CVEs remain unpatched in current downloads
Analyzes and adjusts the volume of MP3 files
Brought to you by:
snelg
Menu
▾
▴
#63 Security summary: 19 known CVEs remain unpatched in current downloads
Summary
mp3gain has accumulated 19 known CVEs over the past two decades. While the v1.6.2 source release mitigated many mpglibDBL vulnerabilities by migrating to system libmpg123, the stable Windows binary (v1.2.5) on the Downloads page and the APE tag handling code (apetag.c) remain vulnerable.
This report is intended as a consolidated reference for users and distribution maintainers.
Current download risks
Windows stable binary (v1.2.5):
- Bundles the vulnerable mpglibDBL library
- All 19 CVEs apply, including CVE-2021-34085 (CVSS 9.8, Critical)
- Processing a crafted MP3 file can lead to arbitrary code execution
Source v1.6.2 (with system libmpg123):
- mpglibDBL vulnerabilities are mitigated
- APE tag vulnerabilities remain: CVE-2023-49356 (CVSS 7.5), CVE-2019-18359 (CVSS 5.5)
- Debian has independently patched these (1.6.2-3), but the upstream source is unpatched
Unpatched CVEs in apetag.c (affect v1.6.2)
| CVE | CVSS | Type |
|---|---|---|
| CVE-2023-49356 | 7.5 (High) | Stack buffer overflow in WriteMP3GainAPETag |
| CVE-2019-18359 | 5.5 (Medium) | Buffer over-read in ReadMP3APETag |
| CVE-2018-10777 | — | Buffer overflow in WriteMP3GainAPETag |
| CVE-2017-12911 | — | Stack memory corruption |
Patches exist — Debian's fix-security-bugs.patch addresses these. See: https://sources.debian.org/patches/mp3gain/1.6.2-3/
mpglibDBL CVEs (affect v1.5.2 and earlier, including the Windows binary)
CVE-2003-0577, CVE-2004-0805, CVE-2004-0991, CVE-2006-1655, CVE-2017-9872, CVE-2017-12912, CVE-2017-14406, CVE-2017-14407, CVE-2017-14408, CVE-2017-14409 (CVSS 7.8), CVE-2017-14410, CVE-2017-14411, CVE-2017-14412, CVE-2018-10776, CVE-2018-10778, CVE-2020-15359, CVE-2021-34085 (CVSS 9.8)
These are mitigated in v1.6.2 when built with system libmpg123, but the Windows download on this project page is v1.2.5, which bundles the vulnerable mpglibDBL.
Distribution patch status
| Distribution | Version | Patched? |
|---|---|---|
| Debian/Ubuntu | 1.6.2-3 | Yes (most comprehensive) |
| openSUSE | 1.6.2 | Partial (2020 security updates) |
| Fedora | 1.6.2 | Partial |
| Homebrew (macOS) | 1.6.2 | No (links to libmpg123 but no apetag.c patches) |
| SourceForge Windows | 1.2.5 | No |
Suggestions
- Apply Debian's APE tag patches to the v1.6.2 source (4 CVEs fixed with minimal changes)
- Remove or replace the v1.2.5 Windows binary — it is vulnerable to remote code execution
- Add a notice to the project page indicating known security issues
If upstream maintenance is not feasible, a note directing users to patched distribution packages (e.g., Debian) or alternative tools would help reduce user risk.
Related bug reports
- Bug #36 — Arbitrary code execution (closed, fixed via libmpg123 migration)
- Bug #47 — Stack buffer overflow in
WriteMP3GainAPETag(open, patch available from Luigi Baldoni) - Bug #50 — Heap/stack buffer overflow in id3 tag parsing (open)
References
- Debian Security Tracker: https://security-tracker.debian.org/tracker/source-package/mp3gain
- CVE-2020-15359 (VDA Labs/Mayhem fuzzer — ~1,600 crashes in 6,000 test cases): https://www.mayhem.security/blog/cve-2020-15359-vdalabs-uses-mayhem-to-find-mp3gain-stack-overflow
- CVE-2023-49356 report: https://github.com/linzc21/bug-reports/blob/main/reports/mp3gain/1.6.2/stack-buffer-overflow/CVE-2023-49356.md
- NVD CVE-2021-34085: https://nvd.nist.gov/vuln/detail/CVE-2021-34085
Update: I was not aware that the Debian/openSUSE security patches had already been applied to master in commit b0d6a5 (2025-11-01, Bug #62). Thank you Glen for applying those.
To clarify the current status:
Fixed in master (not yet released):
WriteMP3GainAPETagReadMP3APETagWriteMP3GainAPETagapetag.cPossibly also addressed: Bugs #56–#60 (heap-buffer-overflow in
ReadMP3APETag) — the Debian patch addsremainingsize checks and field size validation that may cover these cases, but they were reported with specific PoC files and have not been explicitly confirmed as fixed.Still affected (mpglibDBL, Windows binary only):
The v1.2.5 and v1.3.4 Windows binaries on the Downloads page still bundle mpglibDBL and are vulnerable to the 15 mpglibDBL-related CVEs listed above. These are mitigated when building v1.6.2 from source with system libmpg123.
Remaining suggestions: