Sox Ng
Monthly
Out-of-bounds write in sox_ng's VOC decoder up to 14.8.1 can corrupt memory when a victim decodes an attacker-crafted VOC audio file, with low confidentiality, integrity and availability impact and no scope change. Exploitation requires user interaction to open or process the malicious file, so there is no autonomous remote trigger; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L. A public PoC reference exists but is not verified as working exploit code, and no KEV active-exploitation confirmation was provided.
Out-of-bounds write in sox_ng's VOC decoder up to 14.8.1 can corrupt memory when a victim decodes an attacker-crafted VOC audio file, with low confidentiality, integrity and availability impact and no scope change. Exploitation requires user interaction to open or process the malicious file, so there is no autonomous remote trigger; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L. A public PoC reference exists but is not verified as working exploit code, and no KEV active-exploitation confirmation was provided.