A buffer underflow in the ogg123 utility’s remotethread function can corrupt the stack when it processes malformed remote control inputs. The flaw, identified as an incorrect calculation for buffer size or offset, may lead to application crashes and, in the worst case, exploitation that allows an attacker to execute arbitrary code. The weakness corresponds to CWE-124.

The vulnerability affects the ogg123 player shipped with the vorbis‑tools 1.4.3 package. No alternative versions or additional vendor details are reported. Users running this specific release should be aware of the risk.

The flaw has a CVSS score of 8.2, signalling a high severity level. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog, yet the high CVSS still points to significant risk. The flaw can be triggered via the remote control interface of ogg123, making it accessible to any host that can communicate with the service; a crafted command can overflow a stack buffer, potentially leading to denial of service or execution of arbitrary code.