CVE-2017-9872: The III_dequantize_sample function in layer3.c in mpglib, as used in libmpgdecoder.a in LAME 3.99.5 and oth...

Security readout for executives and security teams

A crafted audio file can crash software that uses mpglib inside LAME 3.99.5 or related products. The most clearly supported impact is denial of service. The sources also mention possible unspecified other impact, but do not prove active exploitation or a reliable code-execution path. Exposure is most likely where applications, services, or media-processing pipelines decode untrusted MP3/audio using LAME 3.99.5, mpglib, or bundled libmpgdecoder.a. The affected product list is incomplete and says other products, so embedded or statically linked copies need review. Treat this as a moderate operational risk for systems that process external audio. Prioritize internet-facing upload, transcription, conversion, and scanning services. Business urgency is lower where audio input is trusted or the affected library is absent. Mitigation focus: Identify and update affected LAME, mpglib, or downstream packages using vendor guidance.; Avoid processing untrusted audio files with affected decoder builds until remediated.; Sandbox or isolate media decoding components that handle external files..

Prepared

Jun 13, 2026, 04:43 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.