CVE-2023-47466
TagLib before 2.0 allows a segmentation violation and application crash during tag writing via a...
CVE-2023-47466 is a low vulnerability (CVSS 2.9) in Taglib, published May 22, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 25th percentile. Fixed in taglib 1.12-6.el9.tuxcare.els1.
TagLib before 2.0 allows a segmentation violation and application crash during tag writing via a crafted WAV file in which an id3 chunk is the only valid chunk.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
TagLib before 2.0 allows a segmentation violation and application crash during tag writing via a crafted WAV file in which an id3 chunk is the only valid chunk.
- Record
CVE-2023-47466- CVSS 3.1
- 2.9 Low
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-476
- Updated
- 2026-11-02
EUVDEUVD-2023-51578
TagLib before 2.0 allows a segmentation violation and application crash during tag writing via a crafted WAV file in which an id3 chunk is the only valid chunk.
- Record
EUVD-2023-51578- CVSS 3.1
- 2.9 Low
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-63jr-j347-v237
TagLib before 2.0 allows a segmentation violation and application crash during tag writing via a...
TagLib before 2.0 allows a segmentation violation and application crash during tag writing via a crafted WAV file in which an id3 chunk is the only valid chunk.
- Record
GHSA-63jr-j347-v237- CVSS 3.1
- 2.9 Low
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-476
- Updated
- 2026-11-02
NVD
TagLib before 2.0 allows a segmentation violation and application crash during tag writing via a crafted WAV file in which an id3 chunk is the only valid chunk.
- Record
CVE-2023-47466- CVSS 3.1
- 2.9 Low
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
OSV
TagLib before 2.0 allows a segmentation violation and application crash during tag writing via a crafted WAV file in which an id3 chunk is the only valid chunk.
- Record
CVE-2023-47466- CVSS 3.1
- 2.9 Low
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-476
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-47466
TagLib before 2.0 allows a segmentation violation and application crash during tag writing via a crafted WAV file in which an id3 chunk is the only valid chunk.
- Record
DEBIAN-CVE-2023-47466- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
Show 10 moreShow less
OSVOESA-2025-1638
taglib security update
TagLib is a library for reading and editing the meta-data of several popular audio formats. Currently it supports both ID3v1 and ID3v2 for MP3 files, Ogg Vorbis comments and ID3 tags and Vorbis comments in FLAC, MPC, Speex, WavPack TrueAudio, WAV, AIFF, MP4 and ASF files.
Security Fix(es):
TagLib before 2.0 allows a segmentation violation and application crash during tag writing via a crafted WAV file in which an id3 chunk is the only valid chunk.(CVE-2023-47466)
- Record
OESA-2025-1638- CVSS 3.1
- 2.5 Low
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-47466
TagLib before 2.0 allows a segmentation violation and application crash during tag writing via a crafted WAV file in which an id3 chunk is the only valid chunk.
- Record
UBUNTU-CVE-2023-47466- CVSS 3.1
- 2.9 Low
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
OSVAZL-62441 No score
CVE-2023-47466 affecting package taglib 1.13.1-1
TagLib before 2.0 allows a segmentation violation and application crash during tag writing via a crafted WAV file in which an id3 chunk is the only valid chunk.
- Record
AZL-62441- Updated
- 2026-11-02
OSVAZL-64466 No score
CVE-2023-47466 affecting package taglib 1.13.1-1
TagLib before 2.0 allows a segmentation violation and application crash during tag writing via a crafted WAV file in which an id3 chunk is the only valid chunk.
- Record
AZL-64466- Updated
- 2026-11-02
OSVCLSA-2025-1754552791 No score
taglib: Fix of CVE-2023-47466
- CVE-2023-47466: Fix segmentation violation and application crash during tag writing via crafted WAV file
- Record
CLSA-2025-1754552791- Updated
- 2026-11-02
OSVCLSA-2026-1777540469 No score
taglib: Fix of CVE-2023-47466
- CVE-2023-47466: Fix segmentation violation and application crash during tag writing via crafted WAV file
- Record
CLSA-2026-1777540469- Updated
- 2026-11-02
OSVCLSA-2026-1778161748 No score
taglib: Fix of CVE-2023-47466
- CVE-2023-47466: fix segmentation violation and application crash during tag writing via crafted WAV file in which an id3 chunk is the only valid chunk
- Record
CLSA-2026-1778161748- Updated
- 2026-11-02
OSVCLSA-2026-1791301913 No score
Fix CVE(s): CVE-2023-47466
- SECURITY UPDATE: crash when writing tags to a crafted WAV file
- debian/patches/CVE-2023-47466.patch: return early on an empty chunk list in RIFF::File::updateGlobalSize() (taglib/riff/rifffile.cpp)
- CVE-2023-47466
- Record
CLSA-2026-1791301913- Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2023-47466 No score
CVE-2023-47466 in rootio-taglib - Patched by Root
Root has patched CVE-2023-47466 in the rootio-taglib package for Root:Debian:12. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-12-CVE-2023-47466- Updated
- 2026-11-02
OSVSUSE-SU-2025:4501-1 No score
Security update for taglib
This update for taglib fixes the following issues:
- CVE-2023-47466: application crash when processing specially crafted WAV files during tag writing operations (bsc#1243499).
- Record
SUSE-SU-2025:4501-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
taglibAzure Linux:3 |
through 1.13.1-1 | None known |
taglibAzure Linux:2 |
through 1.13.1-1 | None known |
taglibTuxCare:AlmaLinux:9.2 |
before 1.12-6.el9.tuxcare.els1 | 1.12-6.el9.tuxcare.els1 |
taglib-develTuxCare:AlmaLinux:9.2 |
before 1.12-6.el9.tuxcare.els1 | 1.12-6.el9.tuxcare.els1 |
taglibTuxCare:AlmaLinux:9.6 |
before 1.12-6.el9.tuxcare.els1 | 1.12-6.el9.tuxcare.els1 |
taglib-develTuxCare:AlmaLinux:9.6 |
before 1.12-6.el9.tuxcare.els1 | 1.12-6.el9.tuxcare.els1 |
taglibTuxCare:CentOS:7 |
before 1.8-8.20130218git.el7.tuxcare.els1 | 1.8-8.20130218git.el7.tuxcare.els1 |
taglib-develTuxCare:CentOS:7 |
before 1.8-8.20130218git.el7.tuxcare.els1 | 1.8-8.20130218git.el7.tuxcare.els1 |
taglib-docTuxCare:CentOS:7 |
before 1.8-8.20130218git.el7.tuxcare.els1 | 1.8-8.20130218git.el7.tuxcare.els1 |
libtag1-devTuxCare:Ubuntu:18.04 |
before 1.11.1+dfsg.1-0.2build2+tuxcare.els1 | 1.11.1+dfsg.1-0.2build2+tuxcare.els1 |
Show 24 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libtag1-docTuxCare:Ubuntu:18.04 |
before 1.11.1+dfsg.1-0.2build2+tuxcare.els1 | 1.11.1+dfsg.1-0.2build2+tuxcare.els1 |
libtag1v5TuxCare:Ubuntu:18.04 |
before 1.11.1+dfsg.1-0.2build2+tuxcare.els1 | 1.11.1+dfsg.1-0.2build2+tuxcare.els1 |
libtag1v5-vanillaTuxCare:Ubuntu:18.04 |
before 1.11.1+dfsg.1-0.2build2+tuxcare.els1 | 1.11.1+dfsg.1-0.2build2+tuxcare.els1 |
libtagc0TuxCare:Ubuntu:18.04 |
before 1.11.1+dfsg.1-0.2build2+tuxcare.els1 | 1.11.1+dfsg.1-0.2build2+tuxcare.els1 |
libtagc0-devTuxCare:Ubuntu:18.04 |
before 1.11.1+dfsg.1-0.2build2+tuxcare.els1 | 1.11.1+dfsg.1-0.2build2+tuxcare.els1 |
taglibDebian:12 |
before 1.13-2+deb12u1, plus listed versions 1.13-2 |
1.13-2+deb12u1 |
taglibDebian:13 |
before 2.0.2-1 | 2.0.2-1 |
taglibDebian:14 |
before 2.0.2-1 | 2.0.2-1 |
taglibDebian:11 |
before 1.11.1+dfsg.1-3+deb11u1, plus listed versions 1.11.1+dfsg.1-3 |
1.11.1+dfsg.1-3+deb11u1 |
taglibopenEuler:20.03-LTS-SP4 |
before 1.11.1-13.oe2003sp4 | 1.11.1-13.oe2003sp4 |
taglibopenEuler:22.03-LTS-SP3 |
before 1.11.1-13.oe2203sp3 | 1.11.1-13.oe2203sp3 |
taglibopenEuler:22.03-LTS-SP4 |
before 1.11.1-13.oe2203sp4 | 1.11.1-13.oe2203sp4 |
taglibopenEuler:24.03-LTS |
before 1.13.1-2.oe2403sp1 | 1.13.1-2.oe2403sp1 |
taglibopenEuler:24.03-LTS-SP1 |
before 1.13.1-2.oe2403sp1 | 1.13.1-2.oe2403sp1 |
taglibSUSE:Linux Enterprise Module for Basesystem 15 SP7 |
before 1.13.1-150600.3.3.1 | 1.13.1-150600.3.3.1 |
taglibSUSE:Linux Enterprise Module for Desktop Applications 15 SP7 |
before 1.13.1-150600.3.3.1 | 1.13.1-150600.3.3.1 |
taglibSUSE:Linux Enterprise Module for Package Hub 15 SP7 |
before 1.13.1-150600.3.3.1 | 1.13.1-150600.3.3.1 |
taglibopenSUSE:Leap 15.6 |
before 1.13.1-150600.3.3.1 | 1.13.1-150600.3.3.1 |
taglib-testsopenSUSE:Leap 15.6 |
before 1.13.1-150600.3.3.1 | 1.13.1-150600.3.3.1 |
taglibUbuntu:16.04:LTS |
All versions, plus listed versions 1.9.1-2.4ubuntu1 |
None known |
taglibUbuntu:18.04:LTS |
All versions, plus listed versions 1.11.1+dfsg.1-0.21.11.1+dfsg.1-0.2build11.11.1+dfsg.1-0.2build2 |
None known |
taglibUbuntu:20.04:LTS |
All versions, plus listed versions 1.11.1+dfsg.1-0.31.11.1+dfsg.1-0.3ubuntu11.11.1+dfsg.1-0.3ubuntu2 |
None known |
taglibUbuntu:22.04:LTS |
All versions, plus listed versions 1.11.1+dfsg.1-3ubuntu21.11.1+dfsg.1-3ubuntu3 |
None known |
taglibUbuntu:24.04:LTS |
All versions, plus listed versions 1.13.1-11.13.1-1build1 |
None known |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | affected | |
| 2026-11-02 | created | CVE List, EUVD, GitHub Advisories, NVD, OSV |
References
github.com/taglib/taglib/issues/1163
lists.debian.org/debian-lts-announce/2026/01/msg00022.html
nvd.nist.gov/vuln/detail/CVE-2023-47466
Show 13 moreShow less
errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2025-1754552791.html
security-tracker.debian.org/tracker/CVE-2023-47466
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2025-1638
suse.com/support/update/announcement/2025/suse-su-20254501-1
bugzilla.suse.com/1243499
ubuntu.com/security/CVE-2023-47466
cve.org/CVERecord?id=CVE-2023-47466