libsndfile CVE-2026-88372

Exploitation requires the target application or service to parse an attacker-supplied MAT4 (MATLAB v4) format file using libsndfile 1.2.2; the malformed header fields are what trigger the integer overflow in mat4_read_header(). What limits it: the impact is a crash (availability only) with no code-execution or data-disclosure evidence in the description, and delivery depends on getting the crafted file into a decoding path - realistically implying either a user opening the file or a backend that ingests untrusted audio, despite the supplied vector marking UI:N. Only version 1.2.2 is named, and no fixed release is confirmed.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) scopes this strictly to an availability impact - a denial of service via crashing the parser - with no confidentiality or integrity effect, consistent with CWE-190 integer overflow in mat4_read_header(). No EPSS score, KEV listing, POC, or SSVC decision data was supplied, so exploitation-probability signals are absent. There is one signal worth weighing against the vector: this is a file-format parsing bug in a library, and the sole reference is a GitHub issue tracker entry (libsndfile/libsndfile#1151) rather than a released advisory or patch commit, which means fix availability is unconfirmed. The UI:N in the supplied vector is questionable for a crafted-file parsing flaw - real exploitation normally requires the victim application to be fed the malicious MAT4 file, which usually implies user interaction or a service that ingests untrusted audio; verify context. Net: this is a moderate, availability-only DoS in a widely embedded library, not a high-urgency RCE. No evidence of active exploitation or public exploit code was provided, so it is a patch-in-normal-cycle item rather than an emergency.

An attacker crafts a malformed MAT4 (MATLAB v4) audio file whose header fields trigger an integer overflow in mat4_read_header(), then delivers it to a user or a backend service that decodes audio with libsndfile 1.2.2. When the file is opened, the overflow leads to a crash, denying service to the application or pipeline processing the file. No public exploit code was identified at time of analysis.