CVE-2014-9028
Heap-based buffer overflow in stream_decoder.c in libFLAC before 1.3.1 allows remote attackers to...
Heap-based buffer overflow in stream_decoder.c in libFLAC before 1.3.1 allows remote attackers to execute arbitrary code via a crafted .flac file.
Exploit likelihood
What each source reports
NVD Score used
Heap-based buffer overflow in stream_decoder.c in libFLAC before 1.3.1 allows remote attackers to execute arbitrary code via a crafted .flac file.
- Record
CVE-2014-9028- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Heap-based buffer overflow in stream_decoder.c in libFLAC before 1.3.1 allows remote attackers to execute arbitrary code via a crafted .flac file.
- Record
CVE-2014-9028- Updated
- 2026-11-02
EUVDEUVD-2014-8856 No score
Heap-based buffer overflow in stream_decoder.c in libFLAC before 1.3.1 allows remote attackers to execute arbitrary code via a crafted .flac file.
- Record
EUVD-2014-8856- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6x2f-7ggw-rc86 No score
Heap-based buffer overflow in stream_decoder.c in libFLAC before 1.3.1 allows remote attackers to...
Heap-based buffer overflow in stream_decoder.c in libFLAC before 1.3.1 allows remote attackers to execute arbitrary code via a crafted .flac file.
- Record
GHSA-6x2f-7ggw-rc86- Weakness
- CWE-119
- Updated
- 2026-11-02
OSVBELL-CVE-2014-9028
CVE-2014-9028 does not affect BellSoft software
- Record
BELL-CVE-2014-9028- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
OSV No score
Heap-based buffer overflow in stream_decoder.c in libFLAC before 1.3.1 allows remote attackers to execute arbitrary code via a crafted .flac file.
- Record
CVE-2014-9028- Updated
- 2026-11-02
Show 5 moreShow less
OSVDEBIAN-CVE-2014-9028 No score
Heap-based buffer overflow in stream_decoder.c in libFLAC before 1.3.1 allows remote attackers to execute arbitrary code via a crafted .flac file.
- Record
DEBIAN-CVE-2014-9028- Updated
- 2026-11-02
OSVMGASA-2014-0499 No score
Updated flac packages fix security vulnerabilities
In libFLAC before 1.3.1, a stack overflow (CVE-2014-8962) and a heap overflow (CVE-2014-9028), which may result in arbitrary code execution, can be triggered by passing a maliciously crafted .flac file to the libFLAC decoder.
- Record
MGASA-2014-0499- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10130-1 No score
flac-1.3.1-3.1 on GA media
These are all security issues fixed in the flac-1.3.1-3.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10130-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-9028 No score
Heap-based buffer overflow in stream_decoder.c in libFLAC before 1.3.1 allows remote attackers to execute arbitrary code via a crafted .flac file.
- Record
UBUNTU-CVE-2014-9028- Updated
- 2026-11-02
OSVUSN-2426-1 No score
flac vulnerabilities
Michele Spagnuolo discovered that FLAC incorrectly handled certain malformed audio files. An attacker could use this issue to cause FLAC to crash, resulting in a denial of service, or possibly execute arbitrary code.
- Record
USN-2426-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
flacDebian:12 |
before 1.3.0-3 | 1.3.0-3 |
flacDebian:13 |
before 1.3.0-3 | 1.3.0-3 |
flacDebian:14 |
before 1.3.0-3 | 1.3.0-3 |
flacDebian:6.0 |
before 1.2.1-2+deb6u1, plus listed versions 1.2.1-2 |
1.2.1-2+deb6u1 |
flacDebian:7 |
before 1.2.1-6+deb7u1, plus listed versions 1.2.1-6 |
1.2.1-6+deb7u1 |
flacMageia:4 |
before 1.3.0-2.1.mga4 | 1.3.0-2.1.mga4 |
flacRed Hat:enterprise_linux:6::client |
before 0:1.2.1-7.el6_6 | 0:1.2.1-7.el6_6 |
flac-debuginfoRed Hat:enterprise_linux:6::client |
before 0:1.2.1-7.el6_6 | 0:1.2.1-7.el6_6 |
flac-develRed Hat:enterprise_linux:6::client |
before 0:1.2.1-7.el6_6 | 0:1.2.1-7.el6_6 |
flacRed Hat:enterprise_linux:6::computenode |
before 0:1.2.1-7.el6_6 | 0:1.2.1-7.el6_6 |
Show 26 moreShow less
| Package | Affected | Fixed |
|---|---|---|
flac-debuginfoRed Hat:enterprise_linux:6::computenode |
before 0:1.2.1-7.el6_6 | 0:1.2.1-7.el6_6 |
flac-develRed Hat:enterprise_linux:6::computenode |
before 0:1.2.1-7.el6_6 | 0:1.2.1-7.el6_6 |
flacRed Hat:enterprise_linux:6::server |
before 0:1.2.1-7.el6_6 | 0:1.2.1-7.el6_6 |
flac-debuginfoRed Hat:enterprise_linux:6::server |
before 0:1.2.1-7.el6_6 | 0:1.2.1-7.el6_6 |
flac-develRed Hat:enterprise_linux:6::server |
before 0:1.2.1-7.el6_6 | 0:1.2.1-7.el6_6 |
flacRed Hat:enterprise_linux:6::workstation |
before 0:1.2.1-7.el6_6 | 0:1.2.1-7.el6_6 |
flac-debuginfoRed Hat:enterprise_linux:6::workstation |
before 0:1.2.1-7.el6_6 | 0:1.2.1-7.el6_6 |
flac-develRed Hat:enterprise_linux:6::workstation |
before 0:1.2.1-7.el6_6 | 0:1.2.1-7.el6_6 |
flacRed Hat:enterprise_linux:7::client |
before 0:1.3.0-5.el7_1 | 0:1.3.0-5.el7_1 |
flac-debuginfoRed Hat:enterprise_linux:7::client |
before 0:1.3.0-5.el7_1 | 0:1.3.0-5.el7_1 |
flac-libsRed Hat:enterprise_linux:7::client |
before 0:1.3.0-5.el7_1 | 0:1.3.0-5.el7_1 |
flac-develRed Hat:enterprise_linux:7::client |
before 0:1.3.0-5.el7_1 | 0:1.3.0-5.el7_1 |
flacRed Hat:enterprise_linux:7::computenode |
before 0:1.3.0-5.el7_1 | 0:1.3.0-5.el7_1 |
flac-debuginfoRed Hat:enterprise_linux:7::computenode |
before 0:1.3.0-5.el7_1 | 0:1.3.0-5.el7_1 |
flac-libsRed Hat:enterprise_linux:7::computenode |
before 0:1.3.0-5.el7_1 | 0:1.3.0-5.el7_1 |
flac-develRed Hat:enterprise_linux:7::computenode |
before 0:1.3.0-5.el7_1 | 0:1.3.0-5.el7_1 |
flacRed Hat:enterprise_linux:7::server |
before 0:1.3.0-5.ael7b_1 | 0:1.3.0-5.ael7b_1 |
flac-debuginfoRed Hat:enterprise_linux:7::server |
before 0:1.3.0-5.ael7b_1 | 0:1.3.0-5.ael7b_1 |
flac-libsRed Hat:enterprise_linux:7::server |
before 0:1.3.0-5.ael7b_1 | 0:1.3.0-5.ael7b_1 |
flac-develRed Hat:enterprise_linux:7::server |
before 0:1.3.0-5.ael7b_1 | 0:1.3.0-5.ael7b_1 |
flacRed Hat:enterprise_linux:7::workstation |
before 0:1.3.0-5.el7_1 | 0:1.3.0-5.el7_1 |
flac-debuginfoRed Hat:enterprise_linux:7::workstation |
before 0:1.3.0-5.el7_1 | 0:1.3.0-5.el7_1 |
flac-libsRed Hat:enterprise_linux:7::workstation |
before 0:1.3.0-5.el7_1 | 0:1.3.0-5.el7_1 |
flac-develRed Hat:enterprise_linux:7::workstation |
before 0:1.3.0-5.el7_1 | 0:1.3.0-5.el7_1 |
flacUbuntu:14.04:LTS |
before 1.3.0-2ubuntu0.14.04.1, plus listed versions 1.3.0-11.3.0-2 |
1.3.0-2ubuntu0.14.04.1 |
flacopenSUSE:Tumbleweed |
before 1.3.1-3.1 | 1.3.1-3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-9028 is a high vulnerability (CVSS 7.5) in Flac Libflac, published November 26, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 9.86%, the 95th percentile. Fixed in flac 1.3.0-3.
References
rhn.redhat.com/errata/RHSA-2015-0767.html
packetstormsecurity.com/files/129261/libFLAC-1.3.0-Stack-Overflow-Heap-Overflow-Code-Execution.html
ubuntu.com/usn/USN-2426-1
securityfocus.com/archive/1/534083/100/0/threaded
mandriva.com/security/advisories?name=MDVSA-2015:188
debian.org/security/2014/dsa-3082
Show 28 moreShow less
git.xiph.org?p=flac.git%3Ba=commit%3Bh=fcf0ba06ae12ccd7c67cee3c8d948df15f946b85
advisories.mageia.org/MGASA-2014-0499.html
oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html
lists.opensuse.org/opensuse-updates/2014-12/msg00034.html
ocert.org/advisories/ocert-2014-008.html
nvd.nist.gov/vuln/detail/CVE-2014-9028
github.com/advisories/GHSA-6x2f-7ggw-rc86
docs.bell-sw.com/security/cves/CVE-2014-9028
security-tracker.debian.org/tracker/CVE-2014-9028
bugs.mageia.org/show_bug.cgi?id=14658
access.redhat.com/errata/RHSA-2015:0767
bugzilla.redhat.com/show_bug.cgi?id=1167236
security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0767.json
cve.org/CVERecord?id=CVE-2014-8962
ubuntu.com/security/CVE-2014-9028
suse.com/security/cve/CVE-2014-8962