CVE-2012-2107: Integer overflow in the main function in util/lpci_main.c in Csound before 5.17.2, when converting a file,...

Security readout for executives and security teams

CVE-2012-2107 affects Csound before 5.17.2. A maliciously crafted file can trigger memory corruption during file conversion and may allow arbitrary code execution. The attack appears user-assisted: someone must process the file with the vulnerable utility. Business urgency depends on whether Csound is installed and used with untrusted audio or analysis files. Exposure is most likely on systems with Csound versions earlier than 5.17.2, especially desktops, workstations, or automation workflows that convert externally supplied files. The provided affected-product metadata is incomplete, so inventory should focus on installed Csound or csound5 packages. Prioritize remediation where Csound is installed on user-facing systems or processes untrusted files. The impact can be code execution, but exposure is likely narrower than common enterprise software. If Csound is absent, business risk is minimal. Mitigation focus: Upgrade Csound to version 5.17.2 or later.; Apply relevant vendor package updates where Csound is distro-managed.; Avoid converting untrusted files with vulnerable Csound versions..

Prepared

Jun 14, 2026, 14:50 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.