CVE-2024-41147

An out-of-bounds write vulnerability exists in the ma_dr_flac__decode_samples__lpc functionality...

7.7 HighFix available

An out-of-bounds write vulnerability exists in the ma_dr_flac__decode_samples__lpc functionality of Miniaudio miniaudio v0.11.21. A specially crafted .flac file can lead to memory corruption. An attacker can provide a malicious file to trigger this vulnerability.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: High
Availability: High

Exploit likelihood

0.73%Up 0.7 points since Mar 5, 2025

What each source reports

CVE List Score used 7.7

Record: CVE-2024-41147
CVSS 3.1: 7.7 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H
Weakness: CWE-122
Updated: 2026-11-02

EUVDEUVD-2024-54201 7.7

Record: EUVD-2024-54201
CVSS 3.1: 7.7 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-cchf-xm65-f24c 7.7

An out-of-bounds write vulnerability exists in the ma_dr_flac__decode_samples__lpc functionality...

Record: GHSA-cchf-xm65-f24c
CVSS 3.1: 7.7 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H
Weakness: CWE-122
Updated: 2026-11-02

NVD 7.7

Record: CVE-2024-41147
CVSS 3.1: 7.7 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-122
Updated: 2026-11-02

OSV 7.7

Record: CVE-2024-41147
CVSS 3.1: 7.7 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H
Weakness: CWE-122
Updated: 2026-11-02

OSVDEBIAN-CVE-2024-41147 9.8

Record: DEBIAN-CVE-2024-41147
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2024-41147 7.7

Record: UBUNTU-CVE-2024-41147
CVSS 3.1: 7.7 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`miniaudio` Debian:13	before 0.11.22+dfsg-1	0.11.22+dfsg-1
`miniaudio` Debian:14	before 0.11.22+dfsg-1	0.11.22+dfsg-1
`miniaudio` Ubuntu:24.04:LTS	All versions, plus listed versions 0.11.18+dfsg-10.11.18+dfsg-20.11.20+dfsg-10.11.21+dfsg-1	None known
`miniaudio` Ubuntu:25.10	All versions, plus listed versions 0.11.22+dfsg-1	None known
`miniaudio` Ubuntu:26.10	All versions, plus listed versions 0.11.23+dfsg-10.11.25+dfsg-1	None known
`miniaudio` Ubuntu:26.04:LTS	All versions, plus listed versions 0.11.22+dfsg-10.11.23+dfsg-1	None known

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-41147 is a high vulnerability (CVSS 7.7) in Mackron Miniaudio, published March 4, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.73%, the 54th percentile. Fixed in miniaudio 0.11.22+dfsg-1.