CVE-2026-34253 is a buffer underflow vulnerability (CWE-124) in the ogg123 utility of vorbis-tools 1.4.3, affecting the remotethread function in remote.c. The issue arises from improper handling of malformed input in the remote control feature, leading to a stack buffer underflow. This can result in application crashes and potentially allow an attacker to execute arbitrary code. The CVSS v3.1 score is 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H), indicating a high impact on availability and integrity without confidentiality impact. The vulnerability is publicly known as of May 15, 2026, but no known exploits in the wild have been reported. The Red Hat advisory linked does not provide explicit patch or remediation information.

Successful exploitation can cause application crashes (denial of service) and may allow code execution, impacting system integrity and availability. There is no confidentiality impact reported. The vulnerability can be triggered remotely without privileges or user interaction, increasing its risk.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-34253 for current remediation guidance. Until a patch or official fix is available, avoid processing untrusted input with the affected ogg123 utility's remote control functionality.