CVE-2017-11333

The vorbis_analysis_wrote function in lib/block.c in Xiph.Org libvorbis 1.3.5 allows remote...

5.5 MediumPublic exploitFix available

The vorbis_analysis_wrote function in lib/block.c in Xiph.Org libvorbis 1.3.5 allows remote attackers to cause a denial of service (OOM) via a crafted wav file.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

4.84%Down 2.1 points since Apr 14, 2021

What each source reports

NVD Score used 5.5

The vorbis_analysis_wrote function in lib/block.c in Xiph.Org libvorbis 1.3.5 allows remote attackers to cause a denial of service (OOM) via a crafted wav file.

Record: CVE-2017-11333
CVSS 3.0: 5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness: CWE-476
Updated: 2026-11-02

CVE List No score

The vorbis_analysis_wrote function in lib/block.c in Xiph.Org libvorbis 1.3.5 allows remote attackers to cause a denial of service (OOM) via a crafted wav file.

Record: CVE-2017-11333
Updated: 2026-11-02

EUVDEUVD-2017-2967 No score

The vorbis_analysis_wrote function in lib/block.c in Xiph.Org libvorbis 1.3.5 allows remote attackers to cause a denial of service (OOM) via a crafted wav file.

Record: EUVD-2017-2967
Updated: 2026-11-03

GitHub AdvisoriesGHSA-f5gh-mx7q-w5hf 5.5

The vorbis_analysis_wrote function in lib/block.c in Xiph.Org libvorbis 1.3.5 allows remote...

The vorbis_analysis_wrote function in lib/block.c in Xiph.Org libvorbis 1.3.5 allows remote attackers to cause a denial of service (OOM) via a crafted wav file.

Record: GHSA-f5gh-mx7q-w5hf
CVSS 3.0: 5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-476
Updated: 2026-11-02

OSV 5.5

The vorbis_analysis_wrote function in lib/block.c in Xiph.Org libvorbis 1.3.5 allows remote attackers to cause a denial of service (OOM) via a crafted wav file.

Record: CVE-2017-11333
CVSS 3.0: 5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2017-11333 5.5

The vorbis_analysis_wrote function in lib/block.c in Xiph.Org libvorbis 1.3.5 allows remote attackers to cause a denial of service (OOM) via a crafted wav file.

Record: DEBIAN-CVE-2017-11333
CVSS 3.0: 5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2017-11333 5.5

The vorbis_analysis_wrote function in lib/block.c in Xiph.Org libvorbis 1.3.5 allows remote attackers to cause a denial of service (OOM) via a crafted wav file.

Record: UBUNTU-CVE-2017-11333
CVSS 3.0: 5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVMGASA-2019-0059 No score

Updated libvorbis packages fix security vulnerabilities

The vorbis library version 1.3.6 fix security vulnerabilities:

CVE-2017-11735 libvorbis: NULL pointer dereference in vorbis_block_clear function in lib/block.c
CVE-2017-11333 libvorbis: Memory exhaustion in vorbis_analysis_wrote function in lib/block.c

Record: MGASA-2019-0059
Updated: 2026-11-02

Affected products

xiph.org libvorbis

Affected packages

Affected packages
Package	Affected	Fixed
`libvorbis` Debian:12	before 1.3.5-4.1	1.3.5-4.1
`libvorbis` Debian:13	before 1.3.5-4.1	1.3.5-4.1
`libvorbis` Debian:14	before 1.3.5-4.1	1.3.5-4.1
`libvorbis` Debian:7 From an advisory covering 4 CVEs	before 1.3.2-1.3+deb7u1, plus listed versions 1.3.2-1.3	1.3.2-1.3+deb7u1
`libvorbis` Debian:8 From an advisory covering 2 CVEs	before 1.3.4-2+deb8u3, plus listed versions 1.3.4-21.3.4-2+deb8u11.3.4-2+deb8u2	1.3.4-2+deb8u3
`libvorbis` Debian:9 From an advisory covering 3 CVEs	before 1.3.5-4+deb9u1, plus listed versions 1.3.5-4	1.3.5-4+deb9u1
`libvorbis` Mageia:6 From an advisory covering 2 CVEs	before 1.3.6-1.mga6	1.3.6-1.mga6
`libvorbis` Ubuntu:14.04:LTS	before 1.3.2-1.3ubuntu1.1, plus listed versions 1.3.2-1.31.3.2-1.3ubuntu1	1.3.2-1.3ubuntu1.1
`libvorbis` Ubuntu:16.04:LTS	before 1.3.5-3ubuntu0.1, plus listed versions 1.3.4-21.3.4-31.3.5-21.3.5-3	1.3.5-3ubuntu0.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	libvorbis 1.3.5 - Multiple Vulnerabilities	2017-07-31

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-11333 is a medium vulnerability (CVSS 5.5) in Xiph.org Libvorbis, published July 31, 2017. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 4.84%, the 92nd percentile. Fixed in libvorbis 1.3.5-4.1.

References

Show 9 moreShow less