CVE-2017-11548

The _tokenize_matrix function in audio_out.c in Xiph.Org libao 1.2.0 allows remote attackers to...

5.5 MediumPublic exploitFix available

The _tokenize_matrix function in audio_out.c in Xiph.Org libao 1.2.0 allows remote attackers to cause a denial of service (memory corruption) via a crafted MP3 file.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

3.85%Up 0.4 points since Apr 14, 2021

What each source reports

NVD Score used 5.5

The _tokenize_matrix function in audio_out.c in Xiph.Org libao 1.2.0 allows remote attackers to cause a denial of service (memory corruption) via a crafted MP3 file.

Record: CVE-2017-11548
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness: CWE-119
Updated: 2026-11-02

CVE List No score

The _tokenize_matrix function in audio_out.c in Xiph.Org libao 1.2.0 allows remote attackers to cause a denial of service (memory corruption) via a crafted MP3 file.

Record: CVE-2017-11548
Updated: 2026-11-02

EUVDEUVD-2017-3164 No score

The _tokenize_matrix function in audio_out.c in Xiph.Org libao 1.2.0 allows remote attackers to cause a denial of service (memory corruption) via a crafted MP3 file.

Record: EUVD-2017-3164
Updated: 2026-11-03

GitHub AdvisoriesGHSA-44ff-mrhx-mf5w 5.5

The _tokenize_matrix function in audio_out.c in Xiph.Org libao 1.2.0 allows remote attackers to...

The _tokenize_matrix function in audio_out.c in Xiph.Org libao 1.2.0 allows remote attackers to cause a denial of service (memory corruption) via a crafted MP3 file.

Record: GHSA-44ff-mrhx-mf5w
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-119
Updated: 2026-11-02

OSVALPINE-CVE-2017-11548 5.5

The _tokenize_matrix function in audio_out.c in Xiph.Org libao 1.2.0 allows remote attackers to cause a denial of service (memory corruption) via a crafted MP3 file.

Record: ALPINE-CVE-2017-11548
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVAZL-12122 5.5

CVE-2017-11548 affecting package libao 1.2.0-24

The _tokenize_matrix function in audio_out.c in Xiph.Org libao 1.2.0 allows remote attackers to cause a denial of service (memory corruption) via a crafted MP3 file.

Record: AZL-12122
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 5 moreShow less

OSVAZL-36947 5.5

CVE-2017-11548 affecting package libao 1.2.0-24

The _tokenize_matrix function in audio_out.c in Xiph.Org libao 1.2.0 allows remote attackers to cause a denial of service (memory corruption) via a crafted MP3 file.

Record: AZL-36947
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-05

OSV 5.5

The _tokenize_matrix function in audio_out.c in Xiph.Org libao 1.2.0 allows remote attackers to cause a denial of service (memory corruption) via a crafted MP3 file.

Record: CVE-2017-11548
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-03

OSVDEBIAN-CVE-2017-11548 5.5

The _tokenize_matrix function in audio_out.c in Xiph.Org libao 1.2.0 allows remote attackers to cause a denial of service (memory corruption) via a crafted MP3 file.

Record: DEBIAN-CVE-2017-11548
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2017-11548 5.5

The _tokenize_matrix function in audio_out.c in Xiph.Org libao 1.2.0 allows remote attackers to cause a denial of service (memory corruption) via a crafted MP3 file.

Record: UBUNTU-CVE-2017-11548
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVMGASA-2019-0018 No score

Updated libao packages fix security vulnerability

A flaw was found in libao. The _tokenize_matrix function in audio_out.c in Xiph.Org libao 1.2.0 can cause a denial of service(memory corruption) via a crafted mp3 file (CVE-2017-11548).

Record: MGASA-2019-0018
Updated: 2026-11-02

Affected products

xiph libao

Affected packages

Affected packages
Package	Affected	Fixed
`libao` Alpine:v3.10	before 1.2.0-r3	1.2.0-r3
`libao` Alpine:v3.11	before 1.2.0-r3	1.2.0-r3
`libao` Alpine:v3.12	before 1.2.0-r3	1.2.0-r3
`libao` Alpine:v3.13	before 1.2.0-r3	1.2.0-r3
`libao` Alpine:v3.14	before 1.2.0-r3	1.2.0-r3
`libao` Alpine:v3.5	before 1.2.0-r2	1.2.0-r2
`libao` Alpine:v3.6	before 1.2.0-r2	1.2.0-r2
`libao` Alpine:v3.7	before 1.2.0-r2	1.2.0-r2
`libao` Alpine:v3.8	before 1.2.0-r3	1.2.0-r3
`libao` Alpine:v3.9	before 1.2.0-r3	1.2.0-r3

Show 14 moreShow less

Affected packages
Package	Affected	Fixed
`libao` Azure Linux:2	through 1.2.0-24	None known
`libao` Azure Linux:3	through 1.2.0-24	None known
`libao` Debian:12	All versions, plus listed versions 1.2.2+20180113-1.11.2.2+20180113-1.21.2.2+20180113-1.31.2.2+20180113-1.41.2.2+20180113-1.5	None known
`libao` Debian:13	All versions, plus listed versions 1.2.2+20180113-1.21.2.2+20180113-1.31.2.2+20180113-1.41.2.2+20180113-1.5	None known
`libao` Debian:14	All versions, plus listed versions 1.2.2+20180113-1.21.2.2+20180113-1.31.2.2+20180113-1.41.2.2+20180113-1.5	None known
`libao` Mageia:6	before 1.2.2-3.1.mga6	1.2.2-3.1.mga6
`libao` Ubuntu:16.04:LTS	All versions, plus listed versions 1.1.0-3ubuntu1	None known
`libao` Ubuntu:18.04:LTS	All versions, plus listed versions 1.1.0-3ubuntu11.2.2+20180113-1ubuntu1	None known
`libao` Ubuntu:20.04:LTS	All versions, plus listed versions 1.2.2+20180113-1ubuntu1	None known
`libao` Ubuntu:22.04:LTS	All versions, plus listed versions 1.2.2+20180113-1.1ubuntu11.2.2+20180113-1.1ubuntu21.2.2+20180113-1.1ubuntu3	None known
`libao` Ubuntu:24.04:LTS	All versions, plus listed versions 1.2.2+20180113-1.1ubuntu31.2.2+20180113-1.1ubuntu4	None known
`libao` Ubuntu:25.10	All versions, plus listed versions 1.2.2+20180113-1.2ubuntu1	None known
`libao` Ubuntu:26.10	All versions, plus listed versions 1.2.2+20180113-1.2ubuntu21.2.2+20180113-1.4	None known
`libao` Ubuntu:26.04:LTS	All versions, plus listed versions 1.2.2+20180113-1.2ubuntu11.2.2+20180113-1.2ubuntu2	None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	libao 1.2.0 - Denial of Service	2017-07-31

History

History
Recorded	Changed	Sources
Nov 5, 2026	facts	OSV
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-11548 is a medium vulnerability (CVSS 5.5) in Xiph Libao, published July 31, 2017. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.85%, the 90th percentile. Fixed in libao 1.2.0-r3.

References

Show 5 moreShow less