CVE-2007-3507: FLAC123

High severity, CVSS 9.3. EPSS: 5.5% chance of exploitation in the next 30 days.

Stack-based buffer overflow in the local__vcentry_parse_value function in vorbiscomment.c in flac123 (aka flac-tools or flac) before 0.0.10 allows user-assisted remote attackers to execute arbitrary code via a large comment value_length.

Affected products

• FLAC123 FLAC123: up to and including 0.0.9

Published 2007-07-02. Last modified 2026-06-16.