Sox
Monthly
Heap out-of-bounds write in SoX (the sox CLI and any application linking libsox) through 14.4.2 allows a crafted MS ADPCM WAV file with an odd samplesPerBlock value in its fmt chunk to write a partially controlled 16-bit sample past the heap buffer allocated by wav_ms_adpcm_fmt(), corrupting adjacent memory. Triggering the flaw requires the victim to open or submit the malicious file to sox/libsox (local attack vector, user interaction), but no authentication or privileges are needed; publicly available exploit code exists and no CISA KEV listing is present. The assessed impact is low integrity and high availability (CVSS 3.1 6.9, CWE-787), with exposure concentrated in automated audio-processing services that decode untrusted files.
Heap out-of-bounds write in SoX (the sox CLI and any application linking libsox) through 14.4.2 allows a crafted MS ADPCM WAV file with an odd samplesPerBlock value in its fmt chunk to write a partially controlled 16-bit sample past the heap buffer allocated by wav_ms_adpcm_fmt(), corrupting adjacent memory. Triggering the flaw requires the victim to open or submit the malicious file to sox/libsox (local attack vector, user interaction), but no authentication or privileges are needed; publicly available exploit code exists and no CISA KEV listing is present. The assessed impact is low integrity and high availability (CVSS 3.1 6.9, CWE-787), with exposure concentrated in automated audio-processing services that decode untrusted files.