libmpg123 is built without shadow stack support, most probably due to hand written assembly files missing annotations. Therefore, Fedora applications that link against it are lacking protection at runtime.

As far as I can tell, mpg123 upstream has already fixed this. As of today, the latest "commit" in their SVN repo at svn://scm.orgis.org/mpg123/trunk reads:

------------------------------------------------------------------------
r5542 | thor | 2026-03-24 20:00:42 +0100 (Tue, 24 Mar 2026) | 7 lines

libmpg123: announce shadow stack (and IBT) support for x86-64

This just adds the respective sections to the assembly files if it is enabled
in the compiler. You can build libmpg123 with shadows stack support in the
assembly decoders now. But this is UNTESTED. I hope it just works.


------------------------------------------------------------------------

So it's possibly an easy backport to Fedora.

Some background on why this bug is being filed and marked with a "High" severity:

We (the glibc team) are planning to enable Shadow Stack protection by default in Fedora 45, and this bug report is a result of early testing. Here is a WIP/draft Fedora System-Wide Change Proposal: https://fedoraproject.org/wiki/Changes/ShadowStack

There are some notes in the Documentation section of the change proposal on how to identify and fix smaller issues (such as a stray assembly file without annotations):
https://fedoraproject.org/wiki/Changes/ShadowStack#Documentation
However, in the case of mpg123, looks like upstream has already done the work.

Reproducible: Always