PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-5851 Mp3splt Project CVE debrief

CVE-2017-5851 affects mp3splt 2.6.2 and is caused by a null pointer dereference in free_options() within options_manager.c. A crafted file can trigger a crash of the command-line utility. NVD scores the issue as CVSS 3.0 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) and maps it to CWE-476. The source description also notes that this crash typically has no further consequences for availability, so the practical impact is often limited even though the entry is rated medium severity.

Vendor
Mp3splt Project
Product
CVE-2017-5851
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-03-01
Original CVE updated
2026-05-13
Advisory published
2017-03-01
Advisory updated
2026-05-13

Who should care

Anyone operating mp3splt 2.6.2, especially in workflows that process untrusted or user-supplied media files. This matters most for systems where a crash would interrupt batch processing or where the tool is embedded in automation.

Technical summary

The vulnerable code path is free_options() in options_manager.c. According to the supplied NVD record and linked advisory reference, a crafted file can reach a null pointer dereference and terminate the process. The NVD metadata lists the issue as local, low-complexity, no-privileges, and user-interaction required, with no impact to confidentiality or integrity and availability impact limited to a crash.

Defensive priority

Moderate for environments that routinely ingest untrusted files; low for systems where mp3splt is rarely used or only handles trusted inputs. Prioritize containment and input-sourcing controls over emergency response.

Recommended defensive actions

  • Identify whether mp3splt 2.6.2 is installed or embedded in any processing pipeline.
  • Avoid processing untrusted or externally supplied files with the affected version.
  • Constrain the tool with sandboxing or other execution isolation if it must remain in use.
  • Monitor for unexpected crashes in jobs that invoke mp3splt and treat them as a signal to review input handling.
  • Track upstream project guidance for a patched release or replacement path before continuing broad deployment.

Evidence notes

All claims are derived from the supplied CVE record, the NVD detail, and the linked third-party advisory reference. The CVE was published on 2017-03-01; the 2026-05-13 timestamp is the record modification date, not the issue date. The official record lists mp3splt 2.6.2 as vulnerable and provides the CVSS v3.0 vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H with CWE-476.

Official resources

Publicly disclosed on 2017-03-01 in the CVE/NVD record; the record was last modified on 2026-05-13.