CVE-2007-6279

Multiple double free vulnerabilities in Free Lossless Audio Codec (FLAC) libFLAC before 1.2.1...

9.3 HighFix available

Multiple double free vulnerabilities in Free Lossless Audio Codec (FLAC) libFLAC before 1.2.1 allow user-assisted remote attackers to execute arbitrary code via malformed (1) Seektable values or (2) Seektable Data Offsets in a .FLAC file.

Exploit likelihood

3.98%Down 2.5 points since Feb 4, 2022

What each source reports

NVD Score used9.3

Record: CVE-2007-6279
CVSS 2.0: 9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Weakness: CWE-399
Updated: 2026-11-02

CVE ListNo score

Record: CVE-2007-6279
Updated: 2026-11-02

EUVDEUVD-2007-6247No score

Record: EUVD-2007-6247
Updated: 2026-11-03

GitHub AdvisoriesGHSA-89cg-68j8-8mhgNo score

Multiple double free vulnerabilities in Free Lossless Audio Codec (FLAC) libFLAC before 1.2.1...

Record: GHSA-89cg-68j8-8mhg
Updated: 2026-11-02

OSVNo score

Record: CVE-2007-6279
Updated: 2026-11-02

OSVDEBIAN-CVE-2007-6279No score

Record: DEBIAN-CVE-2007-6279
Updated: 2026-11-02

Affected products

flac libflac

Affected packages

Affected packages
Package	Affected	Fixed
`flac` Debian:12	before 1.2.1-1	1.2.1-1
`flac` Debian:13	before 1.2.1-1	1.2.1-1
`flac` Debian:14	before 1.2.1-1	1.2.1-1

History

History
Recorded	Changed	Sources
Nov 10, 2026	facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	affected, aliases, facts, references, title	GitHub Advisories, OSV
Nov 2, 2026	first indexed	CVE List, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2007-6279 is a high vulnerability (CVSS 9.3) in Flac Libflac, published December 7, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.98%, the 90th percentile. Fixed in flac 1.2.1-1.