PT-2026-41302 · Xiph.Org Foundation · Vorbis-Tools

Published 2026-05-15 · Updated 2026-05-29 · CVE-2026-34253

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions vorbis-tools version 1.4.3

Description A stack buffer underflow exists in the ogg123 utility within the remotethread() function located in remote.c. This issue occurs during the processing of malformed input via the remote control functionality, which can lead to application crashes or potential code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-124

Related Identifiers

CVE-2026-34253

OPENSUSE-SU-2026:10904-1

Affected Products

Vorbis-Tools

References · 16

• 🔥 https://gitlab.xiph.org/xiph/vorbis-tools/-/work_items/2332 · Exploit
• https://ubuntu.com/security/CVE-2026-34253 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-34253 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-34253 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-34253 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34253 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10904-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-34253 · Vendor Advisory
• https://github.com/xiph/vorbis-tools/archive/refs/tags/v1.4.3.tar.gz · Note
• https://github.com/xiph/vorbis-tools/blob/0b3fbf42eb3897d32f4a75baa2dc915a4ca45e8e/ogg123/remote.c#L153 · Note
• https://gitlab.xiph.org/xiph/vorbis-tools/-/commit/4bb4fb33b25949178179f689db9afb477abeb572 · Note
• https://gitlab.xiph.org/xiph/vorbis-tools/-/commit/cfc497a442f51fb4885e132deaf2e0ba067bd280 · Note
• https://suse.com/security/cve/CVE-2026-34253 · Note
• https://gitlab.xiph.org/xiph/vorbis-tools/-/merge_requests/27 · Note
• https://t.me/cveNotify/163918 · Telegram Post