CVE-2023-47466 Null dereference in TagLib
An attacker can cause a denial of service via a crafted WAV file in TagLib, affecting applications using the library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-47466?
CVE-2023-47466 is a low-severity vulnerability in TagLib, published on 22 May 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
TagLib before 2.0 allows a segmentation violation and application crash during tag writing via a crafted WAV file in which an id3 chunk is the only valid chunk.
Weakness: CWE-476
Which versions are affected by CVE-2023-47466?
It affects 1 product.
Linux distribution packages (5)
taglib SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 1.13.1-150600.3.3.1 |
taglib SUSE:Linux Enterprise Module for Desktop Applications 15 SP7 | All versions | 1.13.1-150600.3.3.1 |
taglib SUSE:Linux Enterprise Module for Package Hub 15 SP7 | All versions | 1.13.1-150600.3.3.1 |
taglib openSUSE:Leap 15.6 | All versions | 1.13.1-150600.3.3.1 |
taglib-tests openSUSE:Leap 15.6 | All versions | 1.13.1-150600.3.3.1 |
Products include Taglib Taglib.
How do I fix CVE-2023-47466?
Upgrade to a fixed version.
Is CVE-2023-47466 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-47466 exists.
Sources
Also known as AZL-62441, AZL-64466, CLSA-2025-1754552791, CLSA-2026-1777540469, CLSA-2026-1778161748, CLSA-2026-1791301913 and 6 more.