Skip to main content

libsndfile CVE-2026-37555

| EUVDEUVD-2026-26241 HIGH
Integer Overflow or Wraparound (CWE-190)
2026-04-29 cve@mitre.org
Buffer Overflow Denial Of Service Integer Overflow Libsndfile Libsndfile Project
7.5
CVSS 3.1 · Vendor: mitre
Share

Severity by source

Vendor (mitre) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
7.5 HIGH

Attacker-controlled WAV header fields trigger the overflow with no auth or configuration (PR:N, AC:L); confirmed impact is denial of service, so C:N/I:N/A:H, with AV:N assuming automated file processing.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
8.2 HIGH
qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

6
Source Code Evidence Fetched
Jul 24, 2026 - 05:44 vuln.today
Analysis Generated
Jul 24, 2026 - 05:44 vuln.today
PoC Detected
May 01, 2026 - 18:37 vuln.today
Public exploit code
CVSS changed
Apr 29, 2026 - 20:22 NVD
7.5 (HIGH)
EUVD ID Assigned
Apr 29, 2026 - 16:22 euvd
EUVD-2026-26241
CVE Published
Apr 29, 2026 - 16:16 nvd
HIGH 7.5

DescriptionCVE.org

An issue was discovered in libsndfile 1.2.2 IMA ADPCM codec. The AIFF code path (line 241) was fixed with (sf_count_t) cast, but the WAV code path (line 235) and close path (line 167) were not. When samplesperblock (int) * blocks (int) exceeds INT_MAX, the 32-bit multiplication overflows before being assigned to sf.frames (sf_count_t/int64). With samplesperblock=50000 and blocks=50000, the product 2500000000 overflows to -1794967296. This causes incorrect frame count leading to heap buffer overflow or denial of service. Both values come from the WAV file header and are attacker-controlled. This issue was discovered after an incomplete fix for CVE-2022-33065.

AnalysisAI

Denial of service and potential heap buffer overflow in libsndfile 1.2.2's IMA ADPCM codec allows remote attackers to crash or corrupt memory in any application that parses an attacker-supplied WAV file. The flaw is an integer overflow in the frame-count calculation that was left unpatched in the WAV and close code paths after an incomplete fix for CVE-2022-33065. Publicly available exploit code exists, though EPSS is very low (0.04%, 12th percentile) and it is not on CISA KEV, indicating no observed active exploitation.

Technical ContextAI

libsndfile is a widely used C library for reading and writing sampled audio files (WAV, AIFF, FLAC, etc.), embedded in audio stacks, media players, and server-side transcoding pipelines. The defect lives in the IMA ADPCM decoder (src/ima_adpcm.c, ima_reader_init). Two 32-bit signed integers taken directly from the WAV header, samplesperblock and blocks, are multiplied before the result is stored into psf->sf.frames (a 64-bit sf_count_t). Because the multiplication happens in int arithmetic, values such as 50000 * 50000 = 2,500,000,000 exceed INT_MAX (2,147,483,647) and wrap to a negative number (-1,794,967,296). This is a textbook CWE-190 integer overflow: the AIFF path at line 241 was corrected with an (sf_count_t) cast, but the WAV path (line 235) and the close path (line 167) were missed, so the sign-corrupted frame count propagates into buffer sizing and decode loops.

RemediationAI

Apply the upstream fix commit 9a829113c88a51e57c1e46473e90609e4b7df151 (https://github.com/libsndfile/libsndfile/commit/9a829113c88a51e57c1e46473e90609e4b7df151), which adds the missing (sf_count_t) cast to the WAV frame-count calculation; because this is a commit rather than a confirmed tagged release, a released patched version is not independently verified from the input, so on enterprise Linux prefer the vendor-packaged fixes shipped in the Red Hat errata (e.g. RHSA-2026:19559 and later, https://access.redhat.com/errata/RHSA-2026:19559) and equivalent updates from your distribution. If you cannot patch immediately, apply compensating controls where libsndfile ingests untrusted audio: reject or sanitize IMA ADPCM WAV files at the application boundary and cap declared samplesperblock and blocks so their product cannot approach INT_MAX (trade-off: may break legitimate large-format files), run the decoding process in a sandboxed, resource-limited, restartable worker so a crash degrades gracefully instead of taking down the host service, and disable server-side audio transcoding/preview for user uploads until patched (trade-off: loss of that feature).

More in Libsndfile

View all
CVE-2015-7805 CRITICAL POC
9.3 Nov 17

Heap-based buffer overflow in libsndfile 1.0.25 allows remote attackers to have unspecified impact via the headindex val
CVE-2021-3246 HIGH POC
8.8 Jul 20

A heap buffer overflow vulnerability in msadpcm_decode_block of libsndfile 1.0.30 allows attackers to execute arbitrary

CVE-2018-19662 HIGH POC
8.1 Nov 29

An issue was discovered in libsndfile 1.0.28. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable
CVE-2025-52194 HIGH POC
7.5 Aug 21

A buffer overflow vulnerability exists in libsndfile version 1.2.2 and potentially earlier versions when processing malf
CVE-2024-50613 MEDIUM POC
6.5 Oct 27

libsndfile through 1.2.2 has a reachable assertion, that may lead to application exit, in mpeg_l3_encode.c mpeg_l3_encod
CVE-2018-19758 MEDIUM POC
6.5 Nov 30

There is a heap-based buffer over-read at wav.c in wav_write_header in libsndfile 1.0.28 that will cause a denial of ser
CVE-2018-19661 MEDIUM POC
6.5 Nov 29

An issue was discovered in libsndfile 1.0.28. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitab
CVE-2018-19432 MEDIUM POC
6.5 Nov 22

An issue was discovered in libsndfile 1.0.28. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitab
CVE-2017-12562 CRITICAL
9.8 Aug 05

Heap-based Buffer Overflow in the psf_binheader_writef function in common.c in libsndfile through 1.0.28 allows remote a
CVE-2017-7742 MEDIUM POC
5.5 Apr 12

In libsndfile before 1.0.28, an error in the "flac_buffer_copy()" function (flac.c) can be exploited to cause a segmenta
CVE-2017-7741 MEDIUM POC
5.5 Apr 12

In libsndfile before 1.0.28, an error in the "flac_buffer_copy()" function (flac.c) can be exploited to cause a segmenta
CVE-2019-3832 MEDIUM POC
5.5 Mar 21

It was discovered the fix for CVE-2018-19758 (libsndfile) was not complete and still allows a read beyond the limits of

Same weakness CWE-190 – Integer Overflow or Wraparound

View all
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2017-7529 HIGH
7.5
CVE-2016-1010 HIGH
8.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed

Share

CVE-2026-37555 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy