libsndfile CVE-2026-88386

Requires the victim to open or process an attacker-supplied, specially crafted WAV file with libsndfile 1.2.2 (UI:R, AV:L - the file must be delivered to and parsed on the target). The unaligned 4-byte store in psf_binheader_readf() reliably faults primarily on strict-alignment CPU architectures (ARM, SPARC, MIPS, and UBSan-instrumented builds); on x86/x86-64 the misaligned access is typically tolerated and may not crash, which materially limits real-world impact. No authentication or special server configuration is needed, but exploitation is bounded to a single-process denial of service - no code execution, data disclosure, or integrity impact.

All signals converge on this being a LOW real-world priority despite the 5.5 (medium) CVSS. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) confirms local attack vector with required user interaction and pure availability impact - no confidentiality or integrity loss. EPSS is negligible at 0.14% (3rd percentile), there is no CISA KEV listing, and no public exploit was identified at time of analysis. The only meaningful outcome is a crash (denial of service) of whatever process links libsndfile and opens the malicious WAV. Two caveats worth stating explicitly: (1) the A:H rating is generous - the impact is a single-process crash on file open, not a service-wide outage, so A:L is defensible; and (2) the 'undefined behavior' primarily manifests as a fault (e.g. SIGBUS) on strict-alignment architectures (ARM, SPARC, MIPS) - on x86/x86-64 the unaligned store is typically tolerated and may not crash at all, so real-world DoS is architecture-dependent. This is a robustness/UB hardening fix, not a memory-corruption exploitation primitive.

An attacker crafts a malformed WAV file whose fmt chunk drives psf_binheader_readf() to store a 4-byte value through an unaligned destination pointer, and delivers it to a victim (email attachment, download, media upload pipeline). When the victim's application or service parses the file with libsndfile 1.2.2 on a strict-alignment platform, the misaligned store faults and the process crashes. No public exploit code was identified; the underlying flaw is undefined behavior yielding a crash rather than code execution.