What is the CVSS score of CVE-2026-34253?

CVE-2026-34253 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.1%.

How to fix or mitigate CVE-2026-34253?

Within 24 hours: Identify and inventory all systems running vorbis-tools 1.4.3, particularly those exposed to untrusted network input or remote control functionality. Within 7 days: Implement network-level controls to restrict access to ogg123 remote control interfaces and disable remote control features if not operationally required. Within 30 days: Monitor vendor channels for patch release; migrate to patched version immediately upon availability or replace vorbis-tools with alternative audio processing solution if patch timeline is unacceptable.

vorbis-tools CVE-2026-34253

EUVD-2026-30545 HIGH

Buffer Underwrite ('Buffer Underflow') (CWE-124)

2026-05-15 cve@mitre.org

GHSA-45fh-4474-xc77

RCE

8.2

CVSS 3.1 · Vendor: mitre

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Network scan for ogg123 remote interface
Delivery

Send malformed remote control command
Exploit

Trigger buffer underflow in remotethread
Execution

Corrupt stack memory
Impact

Application crash or code execution

Vulnerability Assessment

Weakness	CWE CWE-124 ASVS 5.0 V15 - Secure Coding and Architecture Buffer boundary checks
Exploitation Conditions	The ogg123 utility must be running with its remote control interface enabled and accessible over the network. This is not a default configuration for most deployments of vorbis-tools, as ogg123 is typically used as a local command-line audio player. The vulnerability specifically requires that the remote control functionality in ogg123 be actively listening for network connections and processing remote commands.
Impact	The CVSS 3.1 score of 8.2 indicates high severity with network-based attack vector (AV:N), low complexity (AC:L), and no required privileges (PR:N) or user interaction (UI:N). The impact is asymmetric - high availability impact but only low integrity impact and no confidentiality impact, suggesting crashes are more likely than reliable code execution. SSVC framework confirms proof-of-concept exists and the vulnerability is automatable, elevating real-world risk. However, absence from CISA KEV suggests no confirmed exploitation in the wild despite POC availability. The combination of network exposure, no authentication requirements, and automation potential makes this a priority for systems exposing ogg123's remote control interface.
Exploit ScenarioDerived	An attacker sends specially crafted remote control commands to a network-exposed ogg123 instance, triggering the buffer underflow in the remotethread function. Given that proof-of-concept code exists per SSVC assessment, exploitation is simplified for attackers who can reach the remote control interface.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 15, 2026

Buffer underflow in vorbis-tools 1.4.3's ogg123 utility allows remote attackers to crash the application or potentially execute code through malformed remote control input. The vulnerability achieves an EPSS score indicating moderate exploitation likelihood, with proof-of-concept code available according to SSVC assessment, though it has not been added to CISA's KEV catalog indicating no confirmed active exploitation.

RemediationAI

No vendor-released patch identified at time of analysis. The references point to source code and issue tracker but not to a fixed release version. As immediate mitigation, disable or restrict access to ogg123's remote control functionality if enabled, or avoid using ogg123 version 1.4.3 in network-exposed configurations. Monitor the Xiph.Org GitLab work item 2332 for patch availability. If remote control functionality is required, implement network segmentation to limit exposure to trusted sources only.

Affected VersionsENISA

n/a n/a

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability affects the ogg123 command-line audio player utility within the vorbis-tools package, specifically in the remotethread function in remote.c. This is a CWE-124 buffer underflow where data is written before the beginning of a buffer on the stack. The remote control functionality appears to process network input without proper bounds checking, allowing malformed commands to corrupt memory below the allocated buffer.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (mitre) PRIMARY 8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

SUSE HIGH

Red Hat 8.2 HIGH

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

CVSS changed

May 15, 2026 - 16:22 NVD

8.2 (HIGH)

CVE Published

May 15, 2026 - 15:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

A buffer underflow vulnerability has been identified in the ogg123 utility from the vorbis-tools 1.4.3 package in function remotethread in remote.c. This vulnerability occurs in the remote control functionality when processing malformed input, leading to a stack buffer underflow that can cause application crashes and potentially allow code execution.

Executive ViewAI

Why It Matters

CVE-2026-34253 is a high-severity buffer underflow vulnerability in vorbis-tools 1.4.3's ogg123 utility that enables remote code execution or application crashes through malformed remote control input, affecting any organization using this audio processing tool in networked or internet-facing deployments.

Business Impact: High

Compensating Controls

Disable ogg123 remote control functionality if not operationally essential; restrict network access to ogg123 instances using host-based firewalls or network segmentation; run ogg123 in sandboxed or containerized environments with minimal privileges; monitor for unexpected process termination or system instability; implement input validation at application boundaries if remote control cannot be disabled.

Threat Intelligence Overview

EPSS Score

0.1%

Top 78% exploitable

Data Quality

8 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment Vendor

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.1%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Out-of-Cycle

Exploitation

Poc

System Exposure· derived

Open

Automatable

Yes

Human Impact

High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +41

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

Same weakness CWE-124 – Buffer Underwrite ('Buffer Underflow')

View all

CVE-2023-48230 CRITICAL POC

9.8

CVE-2023-32614 CRITICAL POC

9.8

CVE-2023-25610 CRITICAL

9.8

CVE-2021-38575 HIGH POC

8.1

CVE-2022-33896 HIGH POC

7.8

CVE-2025-53101 HIGH POC

7.4

CVE-2025-61915 MEDIUM POC

6.7

CVE-2025-62786 MEDIUM POC

6.3

Same technique RCE

View all

CVE-2021-44228 CRITICAL POC

10.0

CVE-2017-7269 CRITICAL POC

9.8

CVE-2022-47966 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2023-3519 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2016-4117 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

Vendor StatusVendor

SUSE

Severity: High

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7	Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP7	Fixed
SUSE Linux Enterprise Server 15 SP7	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP7	Fixed

References

Advisories & patches

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-34253 ADVISORY https://vuldb.com/vuln/364179 REF https://access.redhat.com/security/cve/CVE-2026-34253 REF https://bugzilla.redhat.com/show_bug.cgi?id=2477925 REF https://github.com/xiph/vorbis-tools/archive/refs/tags/v1.4.3.tar.gz REF https://github.com/xiph/vorbis-tools/blob/0b3fbf42eb3897d32f4a75baa2dc915a4ca45e8e/ogg123/remote.c#L153 REF https://gitlab.xiph.org/xiph/vorbis-tools/-/work_items/2332 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34253.json

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back