CVE-2017-15045

low-risk

Published 2017-10-06

LAME 3.99, 3.99.1, 3.99.2, 3.99.3, 3.99.4, 3.99.5, 3.98.4, 3.98.2 and 3.98 has a heap-based buffer over-read in fill_buffer in libmp3lame/util.c, related to lame_encode_buffer_sample_t in libmp3lame/lame.c, a different vulnerability than CVE-2017-9410.

Do I need to act?

0.27% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.5/10 Medium

LOCAL / LOW complexity

Affected Products (1)

Lame

Affected Vendors

Lame Project

References (4)

https://github.com/Hack-Me/Pocs_for_Multi_Versions/tree/main/CVE-2017-15045

Exploit https://sourceforge.net/p/lame/bugs/478/

https://github.com/Hack-Me/Pocs_for_Multi_Versions/tree/main/CVE-2017-15045

Exploit https://sourceforge.net/p/lame/bugs/478/

/ 100

low-risk

Severity 18/34 · Moderate

Exploitability 1/34 · Minimal

Exposure 5/34 · Minimal