CVE-2018-14522: Vulnerability in aubio package
Summary
CVE-2018-14522: An issue was discovered in aubio 0.4.6. A SEGV signal can occur in aubio_pitch_set_unit in pitch/pitch.c, as demonstrated by aubionotes. Affects aubio versions < 0.4.7. Fixed in 0.4.7. How to fix ↓
Also tracked for
- aubio · Debian:11
The same CVE-2018-14522 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The aubio package is a Python library for audio analysis. It provides various functionalities for pitch detection, beat tracking, and other audio processing tasks. The package is widely used in applications related to music and sound analysis. However, a vulnerability has been discovered in version 0.4.6 of the package.
Vulnerability Detail
The vulnerability, identified as PYSEC-2018-62, originates from a flaw in the aubio_pitch_set_unit function in the pitch/pitch.c file. This flaw can lead to a SEGV signal, resulting in a segmentation fault. The vulnerability can be triggered when using aubionotes. The impact of this vulnerability can vary depending on the context in which the aubio package is used, but it has the potential to cause crashes or other unexpected behavior.
How To Fix
Latest published version: 0.4.9 as of 23 Oct 2026
pip install --upgrade "aubio==0.4.9"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.4.7
This is the first release that contains the fix.
pip install --upgrade "aubio==0.4.7"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the aubio package version 0.4.6 is vulnerable to a SEGV signal issue in the aubio_pitch_set_unit function. To mitigate this vulnerability, it is recommended to update the package to version 0.4.7 or later. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for aubio →
FAQ
Aubio is a Python library used for audio analysis tasks such as pitch detection and beat tracking.
The vulnerability can lead to crashes or other unexpected behavior when using the aubio package.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability. No signup is required, and you can analyze your Pipfile.lock to get real-time alerts for open-source vulnerabilities.
Yes, updating the aubio package to version 0.4.7 or later will fix this vulnerability.
You can find more information about this vulnerability in the advisory database at https://github.com/pypa/advisory-database/blob/main/vulns/aubio/PYSEC-2018-62.yaml
Related vulnerabilities
Recent vulnerabilities recorded for aubio.
