CVE-2014-8962
Stack-based buffer overflow in stream_decoder.c in libFLAC before 1.3.1 allows remote attackers...
CVE-2014-8962 is a high vulnerability (CVSS 7.5) in Flac Libflac, published November 26, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 9.86%, the 95th percentile. Fixed in flac 1.3.0-3.
- Severity
- 7.5 HighCVSS 2.0, NVD
- Exploit chance
- 9.86%EPSS, 95th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.3.0-3flac +36 more
Description
Stack-based buffer overflow in stream_decoder.c in libFLAC before 1.3.1 allows remote attackers to execute arbitrary code via a crafted .flac file.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
flacDebian:12 | before 1.3.0-3 | 1.3.0-3 |
flacDebian:13 | before 1.3.0-3 | 1.3.0-3 |
flacDebian:14 | before 1.3.0-3 | 1.3.0-3 |
flacDebian:6.0 From an advisory covering 2 CVEs | before 1.2.1-2+deb6u1, plus listed versions 1.2.1-2 | 1.2.1-2+deb6u1 |
flacDebian:7 From an advisory covering 2 CVEs | before 1.2.1-6+deb7u1, plus listed versions 1.2.1-6 | 1.2.1-6+deb7u1 |
flacMageia:4 From an advisory covering 2 CVEs | before 1.3.0-2.1.mga4 | 1.3.0-2.1.mga4 |
flacRed Hat:enterprise_linux:6::client From an advisory covering 2 CVEs | before 0:1.2.1-7.el6_6 | 0:1.2.1-7.el6_6 |
flac-debuginfoRed Hat:enterprise_linux:6::client From an advisory covering 2 CVEs | before 0:1.2.1-7.el6_6 | 0:1.2.1-7.el6_6 |
flac-develRed Hat:enterprise_linux:6::client From an advisory covering 2 CVEs | before 0:1.2.1-7.el6_6 | 0:1.2.1-7.el6_6 |
flacRed Hat:enterprise_linux:6::computenode From an advisory covering 2 CVEs | before 0:1.2.1-7.el6_6 | 0:1.2.1-7.el6_6 |
Show 27 moreShow less
| Package | Affected | Fixed |
|---|---|---|
flac-debuginfoRed Hat:enterprise_linux:6::computenode From an advisory covering 2 CVEs | before 0:1.2.1-7.el6_6 | 0:1.2.1-7.el6_6 |
flac-develRed Hat:enterprise_linux:6::computenode From an advisory covering 2 CVEs | before 0:1.2.1-7.el6_6 | 0:1.2.1-7.el6_6 |
flacRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 0:1.2.1-7.el6_6 | 0:1.2.1-7.el6_6 |
flac-debuginfoRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 0:1.2.1-7.el6_6 | 0:1.2.1-7.el6_6 |
flac-develRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 0:1.2.1-7.el6_6 | 0:1.2.1-7.el6_6 |
flacRed Hat:enterprise_linux:6::workstation From an advisory covering 2 CVEs | before 0:1.2.1-7.el6_6 | 0:1.2.1-7.el6_6 |
flac-debuginfoRed Hat:enterprise_linux:6::workstation From an advisory covering 2 CVEs | before 0:1.2.1-7.el6_6 | 0:1.2.1-7.el6_6 |
flac-develRed Hat:enterprise_linux:6::workstation From an advisory covering 2 CVEs | before 0:1.2.1-7.el6_6 | 0:1.2.1-7.el6_6 |
flacRed Hat:enterprise_linux:7::client From an advisory covering 2 CVEs | before 0:1.3.0-5.el7_1 | 0:1.3.0-5.el7_1 |
flac-debuginfoRed Hat:enterprise_linux:7::client From an advisory covering 2 CVEs | before 0:1.3.0-5.el7_1 | 0:1.3.0-5.el7_1 |
flac-libsRed Hat:enterprise_linux:7::client From an advisory covering 2 CVEs | before 0:1.3.0-5.el7_1 | 0:1.3.0-5.el7_1 |
flac-develRed Hat:enterprise_linux:7::client From an advisory covering 2 CVEs | before 0:1.3.0-5.el7_1 | 0:1.3.0-5.el7_1 |
flacRed Hat:enterprise_linux:7::computenode From an advisory covering 2 CVEs | before 0:1.3.0-5.el7_1 | 0:1.3.0-5.el7_1 |
flac-debuginfoRed Hat:enterprise_linux:7::computenode From an advisory covering 2 CVEs | before 0:1.3.0-5.el7_1 | 0:1.3.0-5.el7_1 |
flac-libsRed Hat:enterprise_linux:7::computenode From an advisory covering 2 CVEs | before 0:1.3.0-5.el7_1 | 0:1.3.0-5.el7_1 |
flac-develRed Hat:enterprise_linux:7::computenode From an advisory covering 2 CVEs | before 0:1.3.0-5.el7_1 | 0:1.3.0-5.el7_1 |
flacRed Hat:enterprise_linux:7::server From an advisory covering 2 CVEs | before 0:1.3.0-5.ael7b_1 | 0:1.3.0-5.ael7b_1 |
flac-debuginfoRed Hat:enterprise_linux:7::server From an advisory covering 2 CVEs | before 0:1.3.0-5.ael7b_1 | 0:1.3.0-5.ael7b_1 |
flac-libsRed Hat:enterprise_linux:7::server From an advisory covering 2 CVEs | before 0:1.3.0-5.ael7b_1 | 0:1.3.0-5.ael7b_1 |
flac-develRed Hat:enterprise_linux:7::server From an advisory covering 2 CVEs | before 0:1.3.0-5.ael7b_1 | 0:1.3.0-5.ael7b_1 |
flacRed Hat:enterprise_linux:7::workstation From an advisory covering 2 CVEs | before 0:1.3.0-5.el7_1 | 0:1.3.0-5.el7_1 |
flac-debuginfoRed Hat:enterprise_linux:7::workstation From an advisory covering 2 CVEs | before 0:1.3.0-5.el7_1 | 0:1.3.0-5.el7_1 |
flac-libsRed Hat:enterprise_linux:7::workstation From an advisory covering 2 CVEs | before 0:1.3.0-5.el7_1 | 0:1.3.0-5.el7_1 |
flac-develRed Hat:enterprise_linux:7::workstation From an advisory covering 2 CVEs | before 0:1.3.0-5.el7_1 | 0:1.3.0-5.el7_1 |
flacUbuntu:14.04:LTS | before 1.3.0-2ubuntu0.14.04.1, plus listed versions 1.3.0-11.3.0-2 | 1.3.0-2ubuntu0.14.04.1 |
flacUbuntu:14.04:LTS From an advisory covering 2 CVEs | before 1.3.0-2ubuntu0.14.04.1, plus listed versions 1.3.0-11.3.0-2 | 1.3.0-2ubuntu0.14.04.1 |
flacopenSUSE:Tumbleweed From an advisory covering 2 CVEs | before 1.3.1-3.1 | 1.3.1-3.1 |
What each source reports
NVD Score used
Stack-based buffer overflow in stream_decoder.c in libFLAC before 1.3.1 allows remote attackers to execute arbitrary code via a crafted .flac file.
- Record
CVE-2014-8962- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE ListNo score
Stack-based buffer overflow in stream_decoder.c in libFLAC before 1.3.1 allows remote attackers to execute arbitrary code via a crafted .flac file.
- Record
CVE-2014-8962- Updated
- 2026-11-02
EUVDEUVD-2014-8789No score
Stack-based buffer overflow in stream_decoder.c in libFLAC before 1.3.1 allows remote attackers to execute arbitrary code via a crafted .flac file.
- Record
EUVD-2014-8789- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5gr4-m4m2-fjjfNo score
Stack-based buffer overflow in stream_decoder.c in libFLAC before 1.3.1 allows remote attackers...
Stack-based buffer overflow in stream_decoder.c in libFLAC before 1.3.1 allows remote attackers to execute arbitrary code via a crafted .flac file.
- Record
GHSA-5gr4-m4m2-fjjf- Weakness
- CWE-119
- Updated
- 2026-11-02
OSVBELL-CVE-2014-8962
CVE-2014-8962 does not affect BellSoft software
- Record
BELL-CVE-2014-8962- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
OSVNo score
Stack-based buffer overflow in stream_decoder.c in libFLAC before 1.3.1 allows remote attackers to execute arbitrary code via a crafted .flac file.
- Record
CVE-2014-8962- Updated
- 2026-11-02
Show 5 moreShow less
OSVDEBIAN-CVE-2014-8962No score
Stack-based buffer overflow in stream_decoder.c in libFLAC before 1.3.1 allows remote attackers to execute arbitrary code via a crafted .flac file.
- Record
DEBIAN-CVE-2014-8962- Updated
- 2026-11-02
OSVMGASA-2014-0499No score
Updated flac packages fix security vulnerabilities
In libFLAC before 1.3.1, a stack overflow (CVE-2014-8962) and a heap overflow (CVE-2014-9028), which may result in arbitrary code execution, can be triggered by passing a maliciously crafted .flac file to the libFLAC decoder.
- Record
MGASA-2014-0499- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10130-1No score
flac-1.3.1-3.1 on GA media
These are all security issues fixed in the flac-1.3.1-3.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10130-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-8962No score
Stack-based buffer overflow in stream_decoder.c in libFLAC before 1.3.1 allows remote attackers to execute arbitrary code via a crafted .flac file.
- Record
UBUNTU-CVE-2014-8962- Updated
- 2026-11-02
OSVUSN-2426-1No score
flac vulnerabilities
Michele Spagnuolo discovered that FLAC incorrectly handled certain malformed audio files. An attacker could use this issue to cause FLAC to crash, resulting in a denial of service, or possibly execute arbitrary code.
- Record
USN-2426-1- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
git.xiph.org?p=flac.git%3Ba=commit%3Bh=5b3033a2b355068c11fe637e14ac742d273f076e
rhn.redhat.com/errata/RHSA-2015-0767.html
packetstormsecurity.com/files/129261/libFLAC-1.3.0-Stack-Overflow-Heap-Overflow-Code-Execution.html
ubuntu.com/usn/USN-2426-1
securityfocus.com/bid/71280
Show 30 moreShow less
mandriva.com/security/advisories?name=MDVSA-2015:188
debian.org/security/2014/dsa-3082
advisories.mageia.org/MGASA-2014-0499.html
oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html
lists.opensuse.org/opensuse-updates/2014-12/msg00034.html
ocert.org/advisories/ocert-2014-008.html
nvd.nist.gov/vuln/detail/CVE-2014-8962
github.com/advisories/GHSA-5gr4-m4m2-fjjf
docs.bell-sw.com/security/cves/CVE-2014-8962
security-tracker.debian.org/tracker/CVE-2014-8962
bugs.mageia.org/show_bug.cgi?id=14658
access.redhat.com/errata/RHSA-2015:0767
bugzilla.redhat.com/show_bug.cgi?id=1167236
security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0767.json
cve.org/CVERecord?id=CVE-2014-8962
ubuntu.com/security/CVE-2014-8962
lists.xiph.org/pipermail/flac-dev/2014-November/005185.html
suse.com/security/cve/CVE-2014-8962