CVE-2018-19800: Buffer Overflow in aubio
Summary
CVE-2018-19800: aubio v0.4.0 to v0.4.8 has a Buffer Overflow in new_aubio_tempo. Affects aubio versions >= 0.4.0, < 0.4.9. Fixed in 0.4.9. How to fix ↓
Also tracked for
- aubio · Debian:11
The same CVE-2018-19800 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The aubio package is a Python library for audio analysis. It provides various functions and algorithms for tasks such as beat detection, pitch tracking, and tempo estimation. The vulnerability affects versions 0.4.0 to 0.4.8 of the package.
Vulnerability Detail
The vulnerability, identified as CVE-2018-19800, is a buffer overflow in the new_aubio_tempo function of the aubio package. This vulnerability can be exploited by an attacker to execute arbitrary code or cause a denial-of-service condition. The buffer overflow occurs due to improper input validation, allowing an attacker to provide malicious input that exceeds the bounds of a buffer. This can lead to memory corruption and potentially enable the attacker to gain control over the affected system.
How To Fix
Latest published version: 0.4.9 as of 23 Oct 2026
pip install --upgrade "aubio==0.4.9"The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The buffer overflow vulnerability in the aubio package (CVE-2018-19800) can lead to arbitrary code execution or denial-of-service. It is crucial to update the package to version 0.4.9 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for aubio →
FAQ
The vulnerability can allow an attacker to execute arbitrary code or cause a denial-of-service condition.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock file and the playground will analyze it for any open-source vulnerabilities, including this one.
No, only versions 0.4.0 to 0.4.8 of the aubio package are affected. Versions 0.4.9 and later include a fix for the vulnerability.
No specific workaround has been provided for this vulnerability. It is recommended to update to the latest version of the aubio package.
You can find more information about this vulnerability in the aubio advisory database at https://github.com/pypa/advisory-database/blob/main/vulns/aubio/PYSEC-2019-162.yaml
Related vulnerabilities
Recent vulnerabilities recorded for aubio.
