CVE-2017-9872

Think of audio decoding like reading a specific kind of document. This bug is in the “reader” used by some LAME/mpg decoder builds: if it’s given a specially crafted (malformed) audio file, it can crash the program instead of handling it safely.

The most immediate impact is that your app or service that processes audio can stop working (a denial-of-service) at least for a moment—then you need restarts or fixes to get back to normal.

This matters if your business runs software that uses LAME’s libmpgdecoder.a (for example, LAME 3.99.5 or a build linked against that vulnerable decoder code) and you decode MP3 audio as part of your product or service.

It’s a risk only when a user opens a maliciously crafted audio file (no special login is required, but the attacker still needs the file to be opened/processed). It is reachable in default configurations for affected setups.

This is an AMBER issue because remote attackers can cause a real crash by getting a user to open a specially crafted audio file. There are public proof-of-concept examples, and the likelihood is predicted to be rising, so you should not leave it unpatched.

Focus on upgrading promptly if you process or accept MP3 uploads/links for decoding in your applications.