CVE-2018-14522: Denial of Service Vulnerability in Aubio
Summary
CVE-2018-14522: Aubio is vulnerable to denial of service via aubio_pitch_set_unit function. Affects aubio versions < 0.4.7. Fixed in 0.4.7. How to fix ↓
Also tracked for
- aubio · Debian:11
The same CVE-2018-14522 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Aubio is an open-source audio analysis library that provides functions for pitch detection, beat tracking, and other audio processing tasks. It is commonly used in music information retrieval and audio analysis applications. The vulnerability identified as CVE-2018-14522 affects Aubio version 0.4.6. Aubio's aubio_pitch_set_unit function in pitch/pitch.c is susceptible to a denial of service attack, leading to a SEGV signal. This vulnerability can be exploited by an attacker to crash the application, potentially causing disruption or loss of service.
Vulnerability Detail
The vulnerability arises due to a flaw in the aubio_pitch_set_unit function in pitch/pitch.c. When certain inputs are provided, it triggers a SEGV signal, resulting in a denial of service condition. The issue has been demonstrated in aubionotes. The vulnerability has a CVSS score of 8.8, indicating a high severity level. It is important to note that this vulnerability has been reviewed and confirmed by GitHub.
How To Fix
Latest published version: 0.4.9 as of 23 Oct 2026
pip install --upgrade "aubio==0.4.9"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.4.7
This is the first release that contains the fix.
pip install --upgrade "aubio==0.4.7"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround available for this vulnerability. Upgrading to the patched version is the recommended solution.
Conclusion
The vulnerability in Aubio version 0.4.6, identified as CVE-2018-14522, can lead to a denial of service condition. It is crucial to upgrade to the patched version (0.4.7) to mitigate the risk of exploitation. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for aubio →
FAQ
Aubio is an open-source audio analysis library used for tasks such as pitch detection and beat tracking in music information retrieval and audio analysis applications.
The vulnerability can be exploited by an attacker to cause a denial of service, potentially leading to application crashes and service disruption.
To fix this vulnerability, update your Aubio installation to version 0.4.7 or later.
No, there is no specific workaround available. Upgrading to the patched version is the recommended solution.
The vulnerability has a CVSS score of 8.8, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for aubio.
