EUVD-2026-98900
GHSA-f48f-2357-x2fh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malformed WAV subchunk
-
ExploitDeliver file to victim app
-
ExecutionTrigger uninitialized read in wavlike_subchunk_parse
-
ImpactLeak adjacent process memory
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | Exploitation requires that a libsndfile-based application parse an attacker-supplied WAV file through the WAV parser path reaching wavlike_subchunk_parse (src/wavlike.c) in versions up to and including 1.2.2. The CVSS vector's UI:P means a victim must passively process/open the crafted file - there is no fully remote, zero-interaction trigger, which meaningfully limits mass exploitation. No authentication is needed (PR:N). The practical limiting factors are: the need to get a malicious WAV into a parsing workflow, the user-interaction/processing requirement, and the low-severity outcome (small-scale memory disclosure, VC:L, with no integrity or availability impact). No special non-default configuration is indicated by the description. |
| Impact | This is a genuinely low-priority issue despite the public exploit. The CVSS 4.0 base score of 2.1 is corroborated by its own vector: AV:N (network/remote-reachable via a crafted file) but UI:P (passive user interaction required - a victim must open/process a malicious WAV), PR:N (no privileges), and impact limited to VC:L (low confidentiality) with no integrity or availability impact. CWE-453 (use of uninitialized variable) combined with the 'Information Disclosure' tag and VC:L is consistent - the realistic worst case is leakage of small amounts of adjacent process memory, not code execution or crash. Exploit maturity is E:P (proof-of-concept), and the description confirms public exploit code exists, but there is NO CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation. Signals are internally consistent rather than conflicting; the main caveat is sourcing - all data traces to VulDB and the libsndfile GitHub issue, with no NVD-analyzed CVSS, no vendor advisory, and no patch, since the description states the project was notified but has not responded. Net: a real but minor information-disclosure bug in an unpatched library; prioritize patching/mitigation only where libsndfile processes untrusted audio, well below critical/high items. |
| Exploit ScenarioDerived | An attacker crafts a malformed WAV file with manipulated subchunk data that triggers the uninitialized-variable path in wavlike_subchunk_parse and delivers it to a victim (e.g., via a download, email attachment, or a web service that ingests user-supplied audio). When the victim's application parses the file using libsndfile, uninitialized memory may be read and exposed, leaking a small amount of sensitive process data. Public proof-of-concept exploit code exists, lowering the barrier to reproduction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Information disclosure in libsndfile 1.2.2 and earlier allows remote attackers to trigger use of an uninitialized variable when a crafted WAV file is parsed through wavlike_subchunk_parse in src/wavlike.c, exposing a limited amount of memory contents (CVSS 3.1: 5.3-equivalent vector rated C:L, I:N, A:N; CVSS 4.0 base score 2.1). Affected are applications that link libsndfile and accept attacker-supplied WAV input up to and including version 1.2.2; no authentication is required but the victim must passively process or open the malicious file (UI:P), so there is no zero-interaction remote trigger. Publicly available exploit code exists and was disclosed alongside a project issue report that upstream has not yet responded to, but the issue is not confirmed as actively exploited (not in CISA KEV), and the low-severity, read-only impact keeps overall risk low despite the public PoC.
RemediationAI
No vendor-released patch has been identified at time of analysis: the project was notified via the upstream issue report (https://github.com/libsndfile/libsndfile/issues/1169) but has not responded, and no fixed release version is specified in the available references, so administrators should track that issue and the repository at https://github.com/libsndfile/libsndfile/ for a fix and upgrade as soon as a patched release appears (watch for any version above 1.2.2). Until then, apply targeted compensating controls: prevent untrusted WAV files from reaching the libsndfile parser at all where feasible - for example, re-encode or normalize inbound audio with an independent, strictly validating converter such as a recent FFmpeg build before it is handed to any libsndfile-based component, accepting the trade-off that transcoding may alter audio fidelity and drop container metadata. Where re-encoding is unacceptable, run the parsing component in a least-privilege sandbox (container, seccomp/jail, or separate unprivileged process with restricted filesystem and network access) and restrict WAV ingestion to trusted or authenticated uploaders only, recognizing that sandboxing does not eliminate the uninitialized read itself and adds deployment complexity and latency. Because the impact is limited to small-scale memory disclosure with no integrity or availability effect, these measures are proportionate; additionally, developers of affected applications can instrument builds with MemorySanitizer or Valgrind to detect the uninitialized read and confirm exposure, and can consider zero-initializing the relevant parser state as a local defensive patch if they maintain a fork. Note that blocking or filtering input purely by WAV magic bytes is not an effective mitigation here, since the trigger is a malformed internal chunk layout rather than the file's overall format.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
libsndfile is a widely embedded C library for reading and writing audio file formats (WAV, AIFF, FLAC, Ogg, and others), used directly by audio tooling and indirectly through frameworks and language bindings. The flaw sits in the RIFF/WAVE chunk-handling code of src/wavlike.c, in the function wavlike_subchunk_parse, which walks the subchunk structure of a WAV container and populates program state as it encounters chunk types. The root cause class is CWE-453 (insecure default variable initialization), realized here as use of an uninitialized variable: some local or structure member used by the subchunk parser is read before being assigned when a crafted or malformed chunk layout is supplied, so the parser consumes indeterminate memory contents. Because the effect is a read of uninitialized data rather than a memory-safety write, the observable outcome is limited information disclosure or nondeterministic parser behavior rather than code execution, and it aligns with the assessed vector's confidentiality-only (C:L) rating with no integrity or availability impact. The processing path is reached only through the standard WAV parser for versions up to and including 1.2.2; upstream did not furnish CPE identifiers with this report, so affected-product scoping is taken from the vendor repository and the linked issue rather than from an official CPE binding.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
A victim must open a crafted WAV so UI:R; no auth so PR:N; uninitialized-read leaks limited memory giving C:L, with no integrity or availability impact.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A vulnerability was found in libsndfile up to 1.2.2. This issue affects the function wavlike_subchunk_parse of the file src/wavlike.c of the component WAV Parsing. Performing a manipulation results in use of uninitialized variable. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB