SoX CVE-2026-111157

Exploitation requires that a victim process an attacker-supplied MS ADPCM-encoded WAV file in which the fmt chunk's samplesPerBlock field is set to an odd value; this is the specific trigger. The affected code path is MS ADPCM WAV decoding in SoX (sox CLI) or any downstream application linking libsox, so any product version through 14.4.2 that accepts untrusted WAV input is in scope. LIMITING FACTORS: the attack vector is local/file-based (AV:L) and requires user interaction (UI:P) - the attacker cannot trigger it remotely without the victim opening or feeding the file to sox/libsox; no authentication or special privileges are needed (PR:N). Risk concentrates in automated services that decode untrusted audio; purely interactive, trusted-input usage is far less exposed.

This is a moderate-severity memory-corruption flaw (CWE-787, heap out-of-bounds write) whose signals are internally consistent rather than conflicting. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H, score 6.9) describes a local, low-complexity, unauthenticated issue that nonetheless requires user interaction - i.e. a victim must open or process an attacker-supplied file. There is no network vector; exploitation is file-driven, so real-world risk is bounded by how the crafted WAV reaches a victim. Public exploit code exists (POC=YES, reported by VulnCheck), which raises the practical likelihood of opportunistic use, but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active, widespread exploitation - the signals point to a disclosed-but-not-yet-weaponized bug. The impact profile is skewed toward availability (VA:H, denial of service via heap corruption / crash) with only partial integrity impact (VI:L, a partially controlled 16-bit write) and no confidentiality impact (VC:N); the description does not substantiate reliable arbitrary code execution, only a partially controlled out-of-bounds write. Net: a genuine but not top-priority issue - prioritize for any service that auto-ingests untrusted audio via libsox, deprioritize for interactive desktop-only use.

An attacker crafts a malicious MS ADPCM WAV file whose fmt chunk specifies an odd samplesPerBlock value and delivers it to a victim (e.g. as an email attachment, upload, or media file processed by a backend). When the victim runs sox on the file or an application built on libsox decodes it, lsx_ms_adpcm_block_expand_i() writes a partially controlled 16-bit sample past the allocated heap buffer, corrupting heap memory. Public exploit/writeup material is available, so the trigger condition is documented and reproducible.