sox_ng CVE-2026-129264

Exploitation requires the victim to decode an attacker-crafted VOC-format audio file using sox_ng's VOC Decoder (the read_samples_voc function in src/voc.c), in versions up to and including 14.8.1. The primary limiting factor is required user interaction (CVSS UI:P): the malicious file must be opened/processed by sox_ng, so there is no autonomous remote trigger - the bug does not fire without someone (or an automated media pipeline) feeding the crafted file to the decoder. The vendor vector also lists PR:L, implying some privilege context, though no specific configuration or feature-enable toggle is named in the sources; the trigger condition is simply processing a malformed VOC file. Realistic impact is bounded by the Low C/I/A ratings and no scope change.

This is a low-priority issue despite being a memory-corruption (out-of-bounds write, CWE-787) bug. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L) yields a base score of only 2.0, with all three impact dimensions rated Low and no subsequent-system impact. The SSVC/priority Decision label is 'monitor' (not act_now or emergency), there is no CISA KEV listing, and no EPSS score is provided in the input, so there is no signal of active or widespread exploitation. The only exploit-maturity signal is E:P (Proof-of-Concept) plus a PoC reference, but the input states it is 'reference only, not verified as working exploit code' - so a public PoC reference exists; it is not verified as working exploit code, and this must not be read as active exploitation. The network attack vector (AV:N) reflects that a malicious VOC file can be delivered remotely, but exploitation still requires a victim to decode that file (UI:P), which materially limits real-world risk. Note a tension worth verifying: the vendor-supplied vector uses PR:L, implying some privilege is required, yet the flaw is in file-format parsing where crafting a malicious input typically needs no authentication - verify the privilege assumption with the vendor. Overall this reads as a genuine-but-minor local file-parsing bug, not a high-urgency network threat.

An attacker crafts a malformed VOC audio file that triggers the out-of-bounds write in read_samples_voc() and delivers it to a victim (e.g., as an email attachment, download, or media processed by a service using sox_ng). When the victim or an automated pipeline decodes the file with sox_ng (≤14.8.1), the parser writes past the intended buffer, corrupting memory. A public PoC reference exists but is not verified as working exploit code, and the measured impact is limited (Low confidentiality/integrity/availability).