CVE-2024-21522
- State
- Published
- Severity
- 7.5 High
- Published
- Jul 10, 2024
- Updated
- Jul 10, 2026
- Reserved
- Dec 22, 2023
Description
All versions of the package audify are vulnerable to Improper Validation of Array Index when frameSize is provided to the new OpusDecoder().decode or new OpusDecoder().decodeFloat functions it is not checked for negative values. This can lead to a process crash.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P | snyk |
Weaknesses
- CWE-129 Improper Validation of Array Index
Affected Products
| Product | Versions |
|---|---|
audifyn/a |
|
References
- https://security.snyk.io/vuln/SNYK-JS-AUDIFY-6370700
- https://github.com/almoghamdani/audify/blob/94b2fe79dc528fda2c7d59c7a0fd0e9de07dc3dc/src/opus_decoder.cpp%23L53
- https://github.com/almoghamdani/audify/blob/94b2fe79dc528fda2c7d59c7a0fd0e9de07dc3dc/src/opus_decoder.cpp%23L79
- https://gist.github.com/dellalibera/6bb866ae5d1cc2adaabe27bbd6d2d21e
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.