CVE-2018-14521: Aubio - Denial of Service Vulnerability
Summary
CVE-2018-14521: Aubio is vulnerable to denial of service via aubio_source_avcodec_readframe function. Affects aubio versions < 0.4.7. Fixed in 0.4.7. How to fix ↓
Also tracked for
- aubio · Debian:11
The same CVE-2018-14521 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Aubio is an open-source Python package available on PyPI that provides audio analysis functionalities. It is commonly used for tasks such as beat detection, pitch tracking, and onset detection. The package allows developers to process audio data and extract various features from it. However, a vulnerability has been discovered in version 0.4.6 of Aubio, which can lead to a denial of service (DoS) attack. This vulnerability affects the 'aubio_source_avcodec_readframe' function in the 'io/source_avcodec.c' file, as demonstrated by 'aubiomfcc'.
Vulnerability Detail
The vulnerability in Aubio arises due to a segmentation fault (SEGV) signal that can occur when executing the 'aubio_source_avcodec_readframe' function. This can be exploited by an attacker to cause a DoS condition, potentially leading to the disruption of audio processing operations. The issue has been assigned the identifier CVE-2018-14521 and has a CVSS v3 score of 8.8, indicating a high severity level. The vulnerability was published on May 14, 2022, and its details can be found in the GitHub Security Advisory GHSA-rcv6-7hmv-fj7h.
How To Fix
Latest published version: 0.4.9 as of 23 Oct 2026
pip install --upgrade "aubio==0.4.9"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.4.7
This is the first release that contains the fix.
pip install --upgrade "aubio==0.4.7"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been provided for this vulnerability. It is essential to update Aubio to the latest version to mitigate the risk of a DoS attack.
Conclusion
In conclusion, Aubio version 0.4.6 is vulnerable to a denial of service (DoS) attack. To mitigate this risk, it is crucial to update Aubio to version 0.4.7 or later. This can be done by running 'pip install --upgrade aubio'. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for aubio →
FAQ
Aubio is an open-source Python package that provides audio analysis functionalities, allowing developers to process audio data and extract various features from it.
The vulnerability in Aubio can lead to a denial of service (DoS) condition, potentially disrupting audio processing operations.
To fix the vulnerability, it is recommended to upgrade Aubio to version 0.4.7 or later by running 'pip install --upgrade aubio'.
No workaround has been provided for this vulnerability. Updating Aubio to the latest version is the recommended solution.
More information about this vulnerability can be found in the GitHub Security Advisory GHSA-rcv6-7hmv-fj7h.
References
Related vulnerabilities
Recent vulnerabilities recorded for aubio.
