An error in the "read_metadata_vorbiscomment_()" function (src/libFLAC/stream_decoder.c)…
Priority LOW 28CWE-772Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-772.
Summary
An error in the "read_metadata_vorbiscomment_()" function (src/libFLAC/stream_decoder.c) in FLAC version 1.3.2 can be exploited to cause a memory leak via a specially crafted FLAC file.
Why it matters now
EPSS 0.01336 71st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| FLAC | FLAC | 1.3.2 | — | No fix listed | CNA |
- FLAC VendorFLAC Affected 1.3.2 Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:flac_project:flac:*:*:*:*:*:*:*:* | up to 1.3.2 | Vulnerable | Flac Project |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* | 32 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | 33 | Vulnerable | Fedoraproject |
- cpe:2.3:a:flac_project:flac:*:*:*:*:*:*:*:* Versions up to 1.3.2 Vulnerable ·Flac Project
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
Not affected: 4 products
- Red Hat Enterprise Linux 5
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
Timeline
- 2026-10-02 Threatist record created from CVE-2017-6888
- 2026-10-03 Alias added: GHSA-fmrx-65vg-qvjw
References
Advisory 5
More FLAC vulnerabilities
- TI-2007-05985 Multiple buffer overflows in Free Lossless Audio Codec (FLAC) libFLAC before 1.2.1 allow… CVSS 2.0HIGH 9.3
- TI-2007-04471 Multiple integer overflows in Free Lossless Audio Codec (FLAC) libFLAC before 1.2.1, as… CVSS 2.0HIGH 9.3
- TI-2007-05987 Multiple double free vulnerabilities in Free Lossless Audio Codec (FLAC) libFLAC before… CVSS 2.0HIGH 9.3
- TI-2014-07354 Heap-based buffer overflow in stream_decoder.c in libFLAC before 1.3.1 allows remote… CVSS 2.0HIGH 7.5
- TI-2014-07313 Stack-based buffer overflow in stream_decoder.c in libFLAC before 1.3.1 allows remote… CVSS 2.0HIGH 7.5
- TI-2007-05986 Free Lossless Audio Codec (FLAC) libFLAC before 1.2.1 allows user-assisted remote… CVSS 2.0HIGH 9.3
Sources
- CVE-2017-6888 · CVE Program
- CVE-2017-6888 · NVD
- FIRST EPSS
- GHSA-fmrx-65vg-qvjw · GitHub Advisory Database · CC BY 4.0
- CVE-2017-6888 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences