Description
An off-by-one error in function wav_read_header in src/wav.c in Libsndfile 1.1.0, results in a write out of bound, which allows an attacker to execute arbitrary code, Denial of Service or other unspecified impacts.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | libsndfile +2 | 1.2.2-3.amzn2023.0.1 | ALAS2023-2024-572 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | libsndfile | 1.2.2-1 | — |
| Azure Linux 2 (CBL-Mariner) | libsndfile | No fix yet | — |
Advisories 2
- WID-SEC-2023-1906 libsndfile: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 1, 2025
- ALAS2023-2024-572 Moderate: libsndfile security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Mar 21, 2024