Log in Start free

Vulnerability · Published May 15, 2026 · Assigned by mitre

CVE-2026-34253

High 8.2

In plain English

A high-severity security flaw in the vorbis-tools package (Debian). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).

Severity (CVSS 3.1)8.2High
Exploit odds (30 days)0.6%top 52.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A buffer underflow vulnerability has been identified in the ogg123 utility from the vorbis-tools 1.4.3 package in function remotethread in remote.c. This vulnerability occurs in the remote control functionality when processing malformed input, leading to a stack buffer underflow that can cause application crashes and potentially allow code execution.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12vorbis-toolsno fix listedDEBIAN-CVE-2026-34253
Debian:13vorbis-toolsno fix listedDEBIAN-CVE-2026-34253
Debian:14vorbis-toolsno fix listedDEBIAN-CVE-2026-34253
Ubuntu:22.04:LTSvorbis-toolsno fix listedUBUNTU-CVE-2026-34253
Ubuntu:24.04:LTSvorbis-toolsno fix listedUBUNTU-CVE-2026-34253
Ubuntu:25.10vorbis-toolsno fix listedUBUNTU-CVE-2026-34253
Ubuntu:26.04:LTSvorbis-toolsno fix listedUBUNTU-CVE-2026-34253
Ubuntu:26.10vorbis-toolsno fix listedUBUNTU-CVE-2026-34253

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-124 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

References