Audiofile
CVE-2025-50950
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted audio file to audiofile consumer
-
ExploitLibrary enters ModuleState::setup
-
ExecutionNULL pointer dereferenced
-
ImpactProcess crashes (denial of service)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that an application link and invoke audiofile 0.3.7 to process attacker-supplied audio data that reaches the ModuleState::setup code path; the specific malformed-input condition that triggers the NULL dereference is not described in the available sources. The practical limiting factor is that audiofile is a library, not a standalone service - reachability and the real attack vector depend entirely on how the embedding application exposes file parsing (local file open versus a network-facing service), so the input's AV:N should be validated against the actual deployment. Impact is confined to a crash/denial of service (A:H only); there is no confidentiality or integrity consequence. |
| Impact | The input CVSS of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects an availability-only impact - a crash/denial of service - with no confidentiality or integrity loss, consistent with CWE-476 (NULL pointer dereference). The network attack vector (AV:N) is questionable for audiofile, which is a file-parsing library: such a bug is realistically reached by processing a crafted audio file, which is typically a local/file-delivery vector (AV:L) unless the library is wrapped by a network-facing service - verify how the vulnerable path is actually reached before trusting AV:N. The EPSS score is low (0.36%, 30th percentile), indicating little expectation of widespread automated exploitation, which aligns with a mere DoS and the absence of CISA KEV listing (not present in the input). A PoC reference exists but is not verified as working exploit code, so exploitation is unproven. Net: this is a genuine but limited-impact DoS in a niche library - a real-but-moderate priority (the vuln.today label is 'this_week'), not a high-urgency incident. Treat it as scheduled patching rather than emergency response. |
| Exploit ScenarioDerived | An attacker supplies a malformed audio file to an application that uses libaudiofile 0.3.7; during setup within ModuleState::setup, a NULL pointer is dereferenced and the process crashes, denying service to that application or service. A public PoC reference exists (the upstream issue tracker) but it is not verified as working exploit code, and the exact trigger is not described in the available sources. Because the impact is availability only, there is no code execution or data exposure. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
A NULL pointer dereference in audiofile 0.3.7, reached through the ModuleState::setup code path, lets unauthenticated attackers crash applications that use the library to parse attacker-supplied audio data, producing a denial of service with no confidentiality or integrity impact. The NVD CVSS of 7.5 is availability-only (A:H), but it assumes AV:N, whereas the assessed vector is AV:L - the real attack vector depends entirely on whether the embedding application exposes audiofile parsing to remote input or only to locally opened files. No CISA KEV entry exists and EPSS is low at 0.36% (30th percentile); a public PoC reference exists (GitHub issue #66) but is not verified as working exploit code, and the item is prioritized as this_week.
RemediationAI
No vendor-released patch was identified at time of analysis, so no fixed version can be cited; track the upstream issue at https://github.com/mpruett/audiofile/issues/66 and the VulDB entry at https://vuldb.com/vuln/329676 for a corrected release before upgrading audiofile 0.3.7. Until then, the actionable control is containment of the parsing path: where audiofile is used to handle untrusted audio, run that parsing in a separate, sandboxed worker process with memory and restart limits so a NULL dereference only terminates the worker rather than the host service - the trade-off is added architectural complexity plus per-file service degradation and restart churn. If audiofile parsing of untrusted input cannot be isolated, restrict it to trusted or pre-validated files, accepting that this removes the feature's exposure to external content. Finally, confirm the actual attack vector for each deployment: services that accept audio over the network should be treated as remotely reachable and prioritized accordingly, while applications that only parse local files match the assessed AV:L rating.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Audiofile is a C/C++ library (libaudiofile) for reading and writing audio file formats such as WAV and AIFF; it is linked into other programs rather than exposed as a standalone service, which is the key constraint on exploitability. The flaw is a CWE-476 NULL pointer dereference occurring in the ModuleState::setup function; the specific malformed-input condition that drives a pointer to NULL and the subsequent dereference is not described in the available sources. Because the defect lives in a parsing library, reachability is determined by the host application: a program that opens untrusted local files exposes a local attack surface (matching the assessed AV:L vector), while any network-facing service that passes remote audio data into audiofile would realize the NVD AV:N rating - that network exposure must be validated per deployment rather than assumed. The CPE cpe:2.3:a:audiofile:audiofile:0.3.7 confirms version 0.3.7 as the affected release, and impact is bounded to a process crash (A:H only; C:N/I:N).
Know when Audiofile gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
A file-parsing library bug is normally reached via crafted local input, so AV:L; no auth or interaction is intrinsic to the library call, and impact is availability-only (crash).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
DescriptionCVE.org
Audiofile v0.3.7 was discovered to contain a NULL pointer dereference via the ModuleState::setup function.
Executive ViewAI
CVE-2025-50950 is a denial-of-service vulnerability in the audiofile 0.3.7 library (NULL pointer dereference). Any application that uses audiofile to parse audio data could crash if given a malicious file. The risk is highest for services that accept audio uploads from untrusted sources; purely local usage is lower risk. No patch is available, so mitigation depends on input validation and isolating affected services.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict audio file uploads to trusted sources, validate file headers and structure before parsing, implement application-level sandboxing (e.g., containers, seccomp) for services using audiofile, and monitor for process crashes to detect attempted exploitation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
Heap-based buffer overflow in the MSADPCM::initializeCoefficients function in MSADPCM.cpp in audiofile (aka libaudiofile
An issue has been discovered in mpruett Audio File Library (aka audiofile) 0.3.6, 0.3.5, 0.3.4, 0.3.3, 0.3.2, 0.3.1, 0.3
Heap-based buffer overflow in the readValue function in FileHandle.cpp in audiofile (aka libaudiofile and Audio File Lib
In autofile Audio File Library 0.3.6, there exists one memory leak vulnerability in printfileinfo, in printinfo.c, which
In Audio File Library (aka audiofile) 0.3.6, there exists one NULL pointer dereference bug in ulaw2linear_buf in G711.cp
The audiofile Audio File Library 0.3.6 has a NULL pointer dereference bug in ModuleState::setup in modules/ModuleState.c
Heap-based buffer overflow in the decodeBlockWAVE function in IMA.cpp in Audio File Library (aka audiofile) 0.3.6, 0.3.5
WAVE.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service (crash) via ve
Integer overflow in modules/MSADPCM.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a d
Integer overflow in sfcommands/sfconvert.c in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause
The runPull function in libaudiofile/modules/BlockCodec.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote at
Heap-based buffer overflow in the Expand3To4Module::run function in libaudiofile/modules/SimpleModule.h in Audio File Li
Exploit-DB