CVE-2017-8419: Lame Project Lame

High severity, CVSS 7.8. EPSS: 1.5% chance of exploitation in the next 30 days.

LAME through 3.99.5 relies on the signed integer data type for values in a WAV or AIFF header, which allows remote attackers to cause a denial of service (stack-based buffer overflow or heap-based buffer overflow) or possibly have unspecified other impact via a crafted file, as demonstrated by mishandling of num_channels.

Affected products

• Lame Project Lame: up to and including 3.99.5

Published 2017-05-02. Last modified 2026-06-17.