Every CVE Search/ Get API key

CVE-2018-7263

The mad_decoder_run() function in decoder.c in Underbit libmad through 0.15.1b allows remote...

9.8 CriticalFix available

CVE-2018-7263 is a critical vulnerability (CVSS 9.8) in Underbit Libmad, published February 20, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.52%, the 84th percentile. Fixed in libmad 0.15.1b-r9.

The mad_decoder_run() function in decoder.c in Underbit libmad through 0.15.1b allows remote attackers to cause a denial of service (SIGABRT because of double free or corruption) or possibly have unspecified other impact via a crafted file. NOTE: this may overlap CVE-2017-11552.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

2.52%Up 1.5 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

The mad_decoder_run() function in decoder.c in Underbit libmad through 0.15.1b allows remote attackers to cause a denial of service (SIGABRT because of double free or corruption) or possibly have unspecified other impact via a crafted file. NOTE: this may overlap CVE-2017-11552.

Record
CVE-2018-7263
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-415
Updated
2026-11-02
CVE List No score

The mad_decoder_run() function in decoder.c in Underbit libmad through 0.15.1b allows remote attackers to cause a denial of service (SIGABRT because of double free or corruption) or possibly have unspecified other impact via a crafted file. NOTE: this may overlap CVE-2017-11552.

Record
CVE-2018-7263
Updated
2026-11-02
EUVDEUVD-2018-18999 No score

The mad_decoder_run() function in decoder.c in Underbit libmad through 0.15.1b allows remote attackers to cause a denial of service (SIGABRT because of double free or corruption) or possibly have unspecified other impact via a crafted file. NOTE: this may overlap CVE-2017-11552.

Record
EUVD-2018-18999
Updated
2026-11-03
GitHub AdvisoriesGHSA-c423-r73f-cv75 9.8

The mad_decoder_run() function in decoder.c in Underbit libmad through 0.15.1b allows remote...

The mad_decoder_run() function in decoder.c in Underbit libmad through 0.15.1b allows remote attackers to cause a denial of service (SIGABRT because of double free or corruption) or possibly have unspecified other impact via a crafted file. NOTE: this may overlap CVE-2017-11552.

Record
GHSA-c423-r73f-cv75
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-415
Updated
2026-11-02
OSVALPINE-CVE-2018-7263 9.8

The mad_decoder_run() function in decoder.c in Underbit libmad through 0.15.1b allows remote attackers to cause a denial of service (SIGABRT because of double free or corruption) or possibly have unspecified other impact via a crafted file. NOTE: this may overlap CVE-2017-11552.

Record
ALPINE-CVE-2018-7263
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSV 9.8

The mad_decoder_run() function in decoder.c in Underbit libmad through 0.15.1b allows remote attackers to cause a denial of service (SIGABRT because of double free or corruption) or possibly have unspecified other impact via a crafted file. NOTE: this may overlap CVE-2017-11552.

Record
CVE-2018-7263
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 5 moreShow less
OSVRHSA-2020:1631 3.3

Red Hat Security Advisory: GStreamer, libmad, and SDL security, bug fix, and enhancement update

Record
RHSA-2020:1631
CVSS 3.0
3.3 LowCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVRLSA-2020:1631 3.3

Low: GStreamer, libmad, and SDL security, bug fix, and enhancement update

The GStreamer library provides a streaming media framework based on graphs of media data filters.

The libmad package is an MPEG audio decoder capable of 24-bit output.

Simple DirectMedia Layer (SDL) is a cross-platform multimedia library designed to provide fast access to the graphics frame buffer and audio device.

Security Fix(es):

  • libmad: Double-free in the mad_decoder_run() function (CVE-2018-7263)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.2 Release Notes linked from the References section.

Record
RLSA-2020:1631
CVSS 3.0
3.3 LowCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2018-7263 9.8

The mad_decoder_run() function in decoder.c in Underbit libmad through 0.15.1b allows remote attackers to cause a denial of service (SIGABRT because of double free or corruption) or possibly have unspecified other impact via a crafted file. NOTE: this may overlap CVE-2017-11552.

Record
UBUNTU-CVE-2018-7263
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2020:1631 No score

Low: GStreamer, libmad, and SDL security, bug fix, and enhancement update

The GStreamer library provides a streaming media framework based on graphs of media data filters.

The libmad package is an MPEG audio decoder capable of 24-bit output.

Simple DirectMedia Layer (SDL) is a cross-platform multimedia library designed to provide fast access to the graphics frame buffer and audio device.

Security Fix(es):

  • libmad: Double-free in the mad_decoder_run() function (CVE-2018-7263)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record
ALSA-2020:1631
Updated
2026-11-02
OSVMGASA-2019-0078 No score

Updated mad packages fix security vulnerability

The mad_decoder_run function in decoder.c in libmad 0.15.1b allows remote attackers to cause a denial of service (memory corruption) via a crafted MP3 file (CVE-2017-11552).

The mad_decoder_run() function in decoder.c in Underbit libmad through 0.15.1b allows attackers to cause a denial of service (SIGABRT because of double free or corruption) or possibly have unspecified other impact via a crafted file (CVE-2018-7263).

Record
MGASA-2019-0078
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libmad
Alpine:v3.11
 before 0.15.1b-r9
0.15.1b-r9
libmad
Alpine:v3.12
 before 0.15.1b-r9
0.15.1b-r9
libmad
Alpine:v3.13
 before 0.15.1b-r9
0.15.1b-r9
libmad
Alpine:v3.14
 before 0.15.1b-r9
0.15.1b-r9
libmad
Alpine:v3.15
 before 0.15.1b-r9
0.15.1b-r9
libmad
Alpine:v3.16
 before 0.15.1b-r9
0.15.1b-r9
libmad
Alpine:v3.17
 before 0.15.1b-r9
0.15.1b-r9
libmad
Alpine:v3.18
 before 0.15.1b-r9
0.15.1b-r9
libmad
Alpine:v3.19
 before 0.15.1b-r9
0.15.1b-r9
libmad
Alpine:v3.20
 before 0.15.1b-r9
0.15.1b-r9
Show 77 moreShow less
Affected packages
PackageAffectedFixed
libmad
Alpine:v3.21
 before 0.15.1b-r9
0.15.1b-r9
libmad
Alpine:v3.22
 before 0.15.1b-r9
0.15.1b-r9
libmad
Alpine:v3.23
 before 0.15.1b-r9
0.15.1b-r9
libmad
Alpine:v3.24
 before 0.15.1b-r9
0.15.1b-r9
SDL2
AlmaLinux:8
 before 2.0.10-2.el8
2.0.10-2.el8
SDL2-devel
AlmaLinux:8
 before 2.0.10-2.el8
2.0.10-2.el8
SDL2-static
AlmaLinux:8
 before 2.0.10-2.el8
2.0.10-2.el8
gstreamer1
AlmaLinux:8
 before 1.16.1-2.el8
1.16.1-2.el8
gstreamer1-devel
AlmaLinux:8
 before 1.16.1-2.el8
1.16.1-2.el8
gstreamer1-plugins-bad-free
AlmaLinux:8
 before 1.16.1-1.el8
1.16.1-1.el8
gstreamer1-plugins-bad-free-devel
AlmaLinux:8
 before 1.16.1-1.el8
1.16.1-1.el8
gstreamer1-plugins-ugly-free
AlmaLinux:8
 before 1.16.1-1.el8
1.16.1-1.el8
libmad
AlmaLinux:8
 before 0.15.1b-25.el8
0.15.1b-25.el8
libmad-devel
AlmaLinux:8
 before 0.15.1b-25.el8
0.15.1b-25.el8
orc
AlmaLinux:8
 before 0.4.28-3.el8
0.4.28-3.el8
orc-compiler
AlmaLinux:8
 before 0.4.28-3.el8
0.4.28-3.el8
orc-devel
AlmaLinux:8
 before 0.4.28-3.el8
0.4.28-3.el8
mad
Mageia:6
 before 0.15.1b-22.2.mga6
0.15.1b-22.2.mga6
SDL
Red Hat:enterprise_linux:8::appstream
 before 0:1.2.15-37.el8
0:1.2.15-37.el8
SDL-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.2.15-37.el8
0:1.2.15-37.el8
SDL-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:1.2.15-37.el8
0:1.2.15-37.el8
SDL-devel
Red Hat:enterprise_linux:8::appstream
 before 0:1.2.15-37.el8
0:1.2.15-37.el8
gstreamer1
Red Hat:enterprise_linux:8::appstream
 before 0:1.16.1-2.el8
0:1.16.1-2.el8
gstreamer1-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.16.1-2.el8
0:1.16.1-2.el8
gstreamer1-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:1.16.1-2.el8
0:1.16.1-2.el8
gstreamer1-devel
Red Hat:enterprise_linux:8::appstream
 before 0:1.16.1-2.el8
0:1.16.1-2.el8
gstreamer1-plugins-bad-free
Red Hat:enterprise_linux:8::appstream
 before 0:1.16.1-1.el8
0:1.16.1-1.el8
gstreamer1-plugins-bad-free-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.16.1-1.el8
0:1.16.1-1.el8
gstreamer1-plugins-bad-free-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:1.16.1-1.el8
0:1.16.1-1.el8
gstreamer1-plugins-base
Red Hat:enterprise_linux:8::appstream
 before 0:1.16.1-1.el8
0:1.16.1-1.el8
gstreamer1-plugins-base-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.16.1-1.el8
0:1.16.1-1.el8
gstreamer1-plugins-base-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:1.16.1-1.el8
0:1.16.1-1.el8
gstreamer1-plugins-base-devel
Red Hat:enterprise_linux:8::appstream
 before 0:1.16.1-1.el8
0:1.16.1-1.el8
gstreamer1-plugins-base-tools-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.16.1-1.el8
0:1.16.1-1.el8
gstreamer1-plugins-good
Red Hat:enterprise_linux:8::appstream
 before 0:1.16.1-1.el8
0:1.16.1-1.el8
gstreamer1-plugins-good-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.16.1-1.el8
0:1.16.1-1.el8
gstreamer1-plugins-good-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:1.16.1-1.el8
0:1.16.1-1.el8
gstreamer1-plugins-good-gtk
Red Hat:enterprise_linux:8::appstream
 before 0:1.16.1-1.el8
0:1.16.1-1.el8
gstreamer1-plugins-good-gtk-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.16.1-1.el8
0:1.16.1-1.el8
gstreamer1-plugins-ugly-free
Red Hat:enterprise_linux:8::appstream
 before 0:1.16.1-1.el8
0:1.16.1-1.el8
gstreamer1-plugins-ugly-free-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.16.1-1.el8
0:1.16.1-1.el8
gstreamer1-plugins-ugly-free-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:1.16.1-1.el8
0:1.16.1-1.el8
libmad
Red Hat:enterprise_linux:8::appstream
 before 0:0.15.1b-25.el8
0:0.15.1b-25.el8
libmad-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:0.15.1b-25.el8
0:0.15.1b-25.el8
libmad-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:0.15.1b-25.el8
0:0.15.1b-25.el8
orc
Red Hat:enterprise_linux:8::appstream
 before 0:0.4.28-3.el8
0:0.4.28-3.el8
orc-compiler
Red Hat:enterprise_linux:8::appstream
 before 0:0.4.28-3.el8
0:0.4.28-3.el8
orc-compiler-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:0.4.28-3.el8
0:0.4.28-3.el8
orc-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:0.4.28-3.el8
0:0.4.28-3.el8
orc-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:0.4.28-3.el8
0:0.4.28-3.el8
orc-devel
Red Hat:enterprise_linux:8::appstream
 before 0:0.4.28-3.el8
0:0.4.28-3.el8
SDL2
Red Hat:enterprise_linux:8::crb
 before 0:2.0.10-2.el8
0:2.0.10-2.el8
SDL2-debuginfo
Red Hat:enterprise_linux:8::crb
 before 0:2.0.10-2.el8
0:2.0.10-2.el8
SDL2-debugsource
Red Hat:enterprise_linux:8::crb
 before 0:2.0.10-2.el8
0:2.0.10-2.el8
SDL2-devel
Red Hat:enterprise_linux:8::crb
 before 0:2.0.10-2.el8
0:2.0.10-2.el8
SDL2-static
Red Hat:enterprise_linux:8::crb
 before 0:2.0.10-2.el8
0:2.0.10-2.el8
gstreamer1-plugins-bad-free-debuginfo
Red Hat:enterprise_linux:8::crb
 before 0:1.16.1-1.el8
0:1.16.1-1.el8
gstreamer1-plugins-bad-free-debugsource
Red Hat:enterprise_linux:8::crb
 before 0:1.16.1-1.el8
0:1.16.1-1.el8
gstreamer1-plugins-bad-free-devel
Red Hat:enterprise_linux:8::crb
 before 0:1.16.1-1.el8
0:1.16.1-1.el8
libmad
Red Hat:enterprise_linux:8::crb
 before 0:0.15.1b-25.el8
0:0.15.1b-25.el8
libmad-debuginfo
Red Hat:enterprise_linux:8::crb
 before 0:0.15.1b-25.el8
0:0.15.1b-25.el8
libmad-debugsource
Red Hat:enterprise_linux:8::crb
 before 0:0.15.1b-25.el8
0:0.15.1b-25.el8
libmad-devel
Red Hat:enterprise_linux:8::crb
 before 0:0.15.1b-25.el8
0:0.15.1b-25.el8
gstreamer1
Rocky Linux:8
 before 0:1.16.1-2.el8
0:1.16.1-2.el8
gstreamer1-plugins-bad-free
Rocky Linux:8
 before 0:1.16.1-1.el8
0:1.16.1-1.el8
gstreamer1-plugins-ugly-free
Rocky Linux:8
 before 0:1.16.1-1.el8
0:1.16.1-1.el8
libmad
Rocky Linux:8
 before 0:0.15.1b-25.el8
0:0.15.1b-25.el8
orc
Rocky Linux:8
 before 0:0.4.28-3.el8
0:0.4.28-3.el8
SDL2
Rocky Linux:8
 before 0:2.0.10-2.el8
0:2.0.10-2.el8
mpg321
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.3.2-1.10.3.2-1.1ubuntu1
 None known
mpg321
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.3.2-1.1ubuntu10.3.2-1.1ubuntu2
 None known
mpg321
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.3.2-3ubuntu1
 None known
mpg321
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.3.2-3.1ubuntu1
 None known
mpg321
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.3.2-3.1ubuntu10.3.2-3.1ubuntu20.3.2-3.3build1
 None known
mpg321
Ubuntu:25.10
 All versions, plus listed versions
0.3.2-4
 None known
mpg321
Ubuntu:26.10
 All versions, plus listed versions
0.3.2-50.3.2-6
 None known
mpg321
Ubuntu:26.04:LTS
 All versions, plus listed versions
0.3.2-40.3.2-5
 None known

History

History
WhenChangedSources
2026-11-03affectedOSV
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 20 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open