CVE-2026-109828
4.3MediumPublished 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-453, CWE-457
Impact
Remote attackers can potentially read uninitialized memory by tricking a user or service into parsing a malicious WAV file. A public exploit exists.
Root cause
The wavlike_subchunk_parse function in src/wavlike.c fails to initialize a variable before use during WAV chunk parsing.
Affected systems
libsndfile up to 1.2.2
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Fix & remediation
No official patched release is available yet as maintainers have not responded; avoid processing untrusted WAV files through libsndfile until an upstream fix or patch for issue #1169 is applied.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A vulnerability was found in libsndfile up to 1.2.2. This issue affects the function wavlike_subchunk_parse of the file src/wavlike.c of the component WAV Parsing. Performing a manipulation results in use of uninitialized variable. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.