-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from a missing NULL check for the resampling context (avr) in the initialization phase of the audio source. When avr creation fails (due to unsupported formats or other errors), subsequent calls to aubio_source_avcodec_readframe attempt to use this NULL context in swr_convert operations. The GitHub patch explicitly adds a NULL check (if (s->avr == NULL) goto beach;) in new_aubio_source_avcodec to prevent this scenario. The crash stack trace in the issue #187 directly implicates aubio_source_avcodec_readframe as the vulnerable function where the NULL dereference occurs.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| aubio | pip | < 0.4.7 | 0.4.7 |