The mpg123 packages, which provide real-time MPEG audio decoding and playback, contain a buffer overflow vulnerability (CVE-2024-10573) triggered during the writing of decoded PCM samples. This flaw could potentially lead to memory corruption. Red Hat has released an updated package (mpg123-1.32.9-1.el8_10) for Red Hat Enterprise Linux 8 and its variants to fix this issue. The advisory rates the impact as moderate and no CVSS score is provided. No exploits are currently known in the wild.

The buffer overflow vulnerability could allow an attacker to cause memory corruption when processing audio data with mpg123. This may lead to application crashes or potentially other impacts depending on exploitation, but no specific exploit details or active exploitation have been reported. The impact is rated moderate by Red Hat Product Security.

Red Hat has released an official security update for mpg123 in Red Hat Enterprise Linux 8 (version 1.32.9-1.el8_10) that fixes the buffer overflow vulnerability. Users should apply this update following Red Hat's guidance at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory.