Skip to main content

libsndfile CVE-2026-37555

| EUVDEUVD-2026-26241 HIGH
Integer Overflow or Wraparound (CWE-190)
2026-04-29 cve@mitre.org
Buffer Overflow Denial Of Service Integer Overflow Libsndfile Libsndfile Project
7.5
CVSS 3.1 · Vendor: mitre
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Craft WAV with oversized samplesperblock and blocks
  2. Delivery
    Deliver file to libsndfile-backed service
  3. Exploit
    Integer overflow yields negative frame count
  4. Execution
    Undersized allocation and heap overflow during decode
  5. Impact
    Worker crash or memory corruption (DoS)

Vulnerability Assessment

Weakness
CWE
CWE-190
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires the target application to parse an attacker-controlled WAV file using libsndfile's IMA ADPCM decode path, with header fields samplesperblock and blocks set so their product exceeds INT_MAX (e.g. 50000 x 50000). No authentication is required (PR:N) and no special product configuration is needed beyond the application accepting and decoding untrusted audio input. Limiting factors: the attack only reaches the vulnerable code when input is actually an IMA ADPCM-encoded WAV routed through ima_reader_init, and real-world reachability depends on whether the host application automatically processes attacker-supplied files versus requiring a user to open one; confirmed impact is availability (crash/DoS), with heap memory corruption possible but not demonstrated to yield code execution.
Impact

The signals are consistent and point to a real but moderate-priority issue. The published CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) scores only availability impact, matching the confirmed denial-of-service outcome; the heap buffer overflow raises the theoretical possibility of memory corruption beyond a crash, but no confidentiality or integrity impact is demonstrated, so treating this primarily as a DoS is prudent. EPSS is very low (0.04%) and CISA SSVC records Exploitation: none, so there is no evidence of in-the-wild use, yet SSVC also marks it Automatable: yes with partial technical impact - meaning mass, hands-off exploitation (e.g. feeding malicious files through an upload/transcode service) is plausible. Publicly available exploit code exists but must not be conflated with active exploitation. One caveat: the AV:N rating assumes a service automatically processes attacker-controlled files; for a file-parsing library the realistic vector often depends on how the host application ingests input, so validate whether your deployment exposes libsndfile to untrusted network-delivered files.
Exploit ScenarioDerived

An attacker uploads a specially crafted IMA ADPCM WAV file whose header declares samplesperblock=50000 and blocks=50000 to a service that uses libsndfile to inspect or transcode audio. When libsndfile parses the header, the 32-bit multiplication overflows to a negative frame count, driving an undersized allocation and out-of-bounds heap access that crashes the worker or corrupts memory. Public proof-of-concept material is available (gist referenced in the intelligence), lowering the effort to reproduce.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 24, 2026

Denial of service and potential heap buffer overflow in libsndfile 1.2.2's IMA ADPCM codec allows remote attackers to crash or corrupt memory in any application that parses an attacker-supplied WAV file. The flaw is an integer overflow in the frame-count calculation that was left unpatched in the WAV and close code paths after an incomplete fix for CVE-2022-33065. Publicly available exploit code exists, though EPSS is very low (0.04%, 12th percentile) and it is not on CISA KEV, indicating no observed active exploitation.

RemediationAI

Apply the upstream fix commit 9a829113c88a51e57c1e46473e90609e4b7df151 (https://github.com/libsndfile/libsndfile/commit/9a829113c88a51e57c1e46473e90609e4b7df151), which adds the missing (sf_count_t) cast to the WAV frame-count calculation; because this is a commit rather than a confirmed tagged release, a released patched version is not independently verified from the input, so on enterprise Linux prefer the vendor-packaged fixes shipped in the Red Hat errata (e.g. RHSA-2026:19559 and later, https://access.redhat.com/errata/RHSA-2026:19559) and equivalent updates from your distribution. If you cannot patch immediately, apply compensating controls where libsndfile ingests untrusted audio: reject or sanitize IMA ADPCM WAV files at the application boundary and cap declared samplesperblock and blocks so their product cannot approach INT_MAX (trade-off: may break legitimate large-format files), run the decoding process in a sandboxed, resource-limited, restartable worker so a crash degrades gracefully instead of taking down the host service, and disable server-side audio transcoding/preview for user uploads until patched (trade-off: loss of that feature).

Affected VersionsENISA

n/a n/a

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

libsndfile is a widely used C library for reading and writing sampled audio files (WAV, AIFF, FLAC, etc.), embedded in audio stacks, media players, and server-side transcoding pipelines. The defect lives in the IMA ADPCM decoder (src/ima_adpcm.c, ima_reader_init). Two 32-bit signed integers taken directly from the WAV header, samplesperblock and blocks, are multiplied before the result is stored into psf->sf.frames (a 64-bit sf_count_t). Because the multiplication happens in int arithmetic, values such as 50000 * 50000 = 2,500,000,000 exceed INT_MAX (2,147,483,647) and wrap to a negative number (-1,794,967,296). This is a textbook CWE-190 integer overflow: the AIFF path at line 241 was corrected with an (sf_count_t) cast, but the WAV path (line 235) and the close path (line 167) were missed, so the sign-corrupted frame count propagates into buffer sizing and decode loops.

Know when Libsndfile gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (mitre) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 7.5 HIGH

Attacker-controlled WAV header fields trigger the overflow with no auth or configuration (PR:N, AC:L); confirmed impact is denial of service, so C:N/I:N/A:H, with AV:N assuming automated file processing.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 8.2 HIGH

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

3
PoC Detected
May 01, 2026 - 18:37 vuln.today
Public exploit code
CVSS changed
Apr 29, 2026 - 20:22 NVD
7.5 (HIGH)
CVE Published
Apr 29, 2026 - 16:16 nvd
HIGH 7.5

DescriptionCVE.org

An issue was discovered in libsndfile 1.2.2 IMA ADPCM codec. The AIFF code path (line 241) was fixed with (sf_count_t) cast, but the WAV code path (line 235) and close path (line 167) were not. When samplesperblock (int) * blocks (int) exceeds INT_MAX, the 32-bit multiplication overflows before being assigned to sf.frames (sf_count_t/int64). With samplesperblock=50000 and blocks=50000, the product 2500000000 overflows to -1794967296. This causes incorrect frame count leading to heap buffer overflow or denial of service. Both values come from the WAV file header and are attacker-controlled. This issue was discovered after an incomplete fix for CVE-2022-33065.

Executive ViewAI

Why It Matters

libsndfile 1.2.2 contains a remote denial-of-service vulnerability allowing attackers to crash applications through malicious audio files, creating service disruption risk for any organization processing user-supplied WAV files. Organizations using affected versions face potential outages in media processing, transcoding, and multimedia services and should prioritize patch deployment.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 88% exploitable
Prevalence
High
core audio-parsing library embedded across Linux desktops, media apps, and servers
Exploit
POC
Public exploit code exists
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC Yes
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

58
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Integer Overflow MEDIUM

Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Libsndfile

View all
CVE-2015-7805 CRITICAL POC
9.3 Nov 17

Heap-based buffer overflow in libsndfile 1.0.25 allows remote attackers to have unspecified impact via the headindex val
CVE-2021-3246 HIGH POC
8.8 Jul 20

A heap buffer overflow vulnerability in msadpcm_decode_block of libsndfile 1.0.30 allows attackers to execute arbitrary

CVE-2018-19662 HIGH POC
8.1 Nov 29

An issue was discovered in libsndfile 1.0.28. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable
CVE-2025-52194 HIGH POC
7.5 Aug 21

A buffer overflow vulnerability exists in libsndfile version 1.2.2 and potentially earlier versions when processing malf
CVE-2024-50613 MEDIUM POC
6.5 Oct 27

libsndfile through 1.2.2 has a reachable assertion, that may lead to application exit, in mpeg_l3_encode.c mpeg_l3_encod
CVE-2018-19758 MEDIUM POC
6.5 Nov 30

There is a heap-based buffer over-read at wav.c in wav_write_header in libsndfile 1.0.28 that will cause a denial of ser
CVE-2018-19661 MEDIUM POC
6.5 Nov 29

An issue was discovered in libsndfile 1.0.28. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitab
CVE-2018-19432 MEDIUM POC
6.5 Nov 22

An issue was discovered in libsndfile 1.0.28. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitab
CVE-2017-12562 CRITICAL
9.8 Aug 05

Heap-based Buffer Overflow in the psf_binheader_writef function in common.c in libsndfile through 1.0.28 allows remote a
CVE-2017-7742 MEDIUM POC
5.5 Apr 12

In libsndfile before 1.0.28, an error in the "flac_buffer_copy()" function (flac.c) can be exploited to cause a segmenta
CVE-2017-7741 MEDIUM POC
5.5 Apr 12

In libsndfile before 1.0.28, an error in the "flac_buffer_copy()" function (flac.c) can be exploited to cause a segmenta
CVE-2019-3832 MEDIUM POC
5.5 Mar 21

It was discovered the fix for CVE-2018-19758 (libsndfile) was not complete and still allows a read beyond the limits of

Same weakness CWE-190 – Integer Overflow or Wraparound

View all
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2026-97229 CRITICAL POC
10.0
CVE-2017-7529 HIGH
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://vuldb.com/vuln/360173 REF https://access.redhat.com/errata/RHSA-2026:19559 REF https://access.redhat.com/errata/RHSA-2026:19560 REF https://access.redhat.com/errata/RHSA-2026:19610 REF https://access.redhat.com/errata/RHSA-2026:23221 REF https://access.redhat.com/errata/RHSA-2026:23222 REF https://access.redhat.com/errata/RHSA-2026:23223 REF https://access.redhat.com/errata/RHSA-2026:25092 REF https://access.redhat.com/errata/RHSA-2026:25197 REF https://access.redhat.com/errata/RHSA-2026:25198 REF https://access.redhat.com/errata/RHSA-2026:25227 REF https://access.redhat.com/errata/RHSA-2026:30078 REF https://access.redhat.com/errata/RHSA-2026:30087 REF https://access.redhat.com/errata/RHSA-2026:30088 REF https://access.redhat.com/errata/RHSA-2026:30089 REF https://access.redhat.com/security/cve/CVE-2026-37555 REF https://bugzilla.redhat.com/show_bug.cgi?id=2463856 REF https://github.com/libsndfile/libsndfile/commit/9a829113c88a51e57c1e46473e90609e4b7df151 REF https://github.com/libsndfile/libsndfile/issues/833 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-37555.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy