Description
An issue was discovered in libsndfile 1.2.2 IMA ADPCM codec. The AIFF code path (line 241) was fixed with (sf_count_t) cast, but the WAV code path (line 235) and close path (line 167) were not. When samplesperblock (int) * blocks (int) exceeds INT_MAX, the 32-bit multiplication overflows before being assigned to sf.frames (sf_count_t/int64). With samplesperblock=50000 and blocks=50000, the product 2500000000 overflows to -1794967296. This causes incorrect frame count leading to heap buffer overflow or denial of service. Both values come from the WAV file header and are attacker-controlled. This issue was discovered after an incomplete fix for CVE-2022-33065.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libsndfile | No fix yet | — |
| Debian 13 | libsndfile | No fix yet | — |
| Debian 12 | libsndfile | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | libsndfile | No fix yet | — |
| Ubuntu 26.04 LTS | libsndfile | No fix yet | — |
| Ubuntu 25.10 | libsndfile | No fix yet | — |
| Ubuntu 24.04 LTS | libsndfile | No fix yet | — |
| Ubuntu 22.04 LTS | libsndfile | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | libsndfile | No fix yet | — |
| Ubuntu Pro 18.04 LTS | libsndfile | No fix yet | — |
| Ubuntu Pro 16.04 LTS | libsndfile | No fix yet | — |
| Ubuntu Pro 14.04 LTS | libsndfile | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | libsndfile +2 | 1.2.2-6.el10_2.1 | RHSA-2026:19560 |
| RHEL 9 | libsndfile +2 | 1.0.31-9.el9_8.1 | RHSA-2026:19610 |
| RHEL 8 | libsndfile +2 | 1.0.28-17.el8_10 | RHSA-2026:19559 |
Show 10 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | libsndfile +2 | 1.2.2-5.el10_0.1 | RHSA-2026:25092 |
| RHEL 9.6 EUS | libsndfile +2 | 1.0.31-9.el9_6.1 | RHSA-2026:23223 |
| RHEL 9.4 E4S | libsndfile +1 | 1.0.31-8.el9_4.2 | RHSA-2026:23222 |
| RHEL 9.2 E4S | libsndfile +1 | 1.0.31-7.el9_2.1 | RHSA-2026:23221 |
| RHEL 8.8 TUS | libsndfile +1 | 1.0.28-14.el8_8 | RHSA-2026:25227 |
| RHEL 8.8 E4S | libsndfile +1 | 1.0.28-14.el8_8 | RHSA-2026:25227 |
| RHEL 8.6 EUS Long Life | libsndfile | 1.0.28-13.el8_6 | RHSA-2026:25198 |
| RHEL 8.6 AUS | libsndfile | 1.0.28-13.el8_6 | RHSA-2026:25198 |
| RHEL 8.4 EUS Long Life | libsndfile | 1.0.28-10.el8_4.2 | RHSA-2026:25197 |
| RHEL 8.4 AUS | libsndfile | 1.0.28-10.el8_4.2 | RHSA-2026:25197 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | libsndfile +2 | 1.2.2-6.el10_2.1 | ALSA-2026:19560 |
| AlmaLinux 9 | libsndfile +2 | 1.0.31-9.el9_8.1 | ALSA-2026:19610 |
| AlmaLinux 8 | libsndfile +2 | 1.0.28-17.el8_10 | ALSA-2026:19559 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | libsndfile | 1.2.2-6.el10_2.1 | RLSA-2026:19560 |
| Rocky Linux 9 | libsndfile | 1.0.31-9.el9_8.1 | RLSA-2026:19610 |
| Rocky Linux 8 | libsndfile | 1.0.28-17.el8_10 | RLSA-2026:19559 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libsndfile | 1.2.2-5.1 | openSUSE-SU-2026:10730-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | libsndfile | 1.2.2-5 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | libsndfile +2 | 1.2.2-6.el10_2.1 | ELSA-2026-19560 |
| Oracle Linux 9 | libsndfile +2 | 1.0.31-9.el9_8.1 | ELSA-2026-19610 |
| Oracle Linux 8 | libsndfile +2 | 1.0.28-17.el8_10 | ELSA-2026-19559 |
Advisories 21
- ALSA-2026:19610 Important: libsndfile security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:19560 Important: libsndfile security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:19559 Important: libsndfile security update AlmaLinux Security Advisories · Oct 29, 2026
- WID-SEC-2026-1316 libsndfile: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Sep 3, 2026
- ELSA-2026-19560 Important: libsndfile security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jul 16, 2026
- RHSA-2026:25227 Red Hat Security Advisory: libsndfile security update Red Hat Security Advisories (RHSA) · Jul 15, 2026
- RHSA-2026:25197 Red Hat Security Advisory: libsndfile security update Red Hat Security Advisories (RHSA) · Jul 15, 2026
- RHSA-2026:25198 Red Hat Security Advisory: libsndfile security update Red Hat Security Advisories (RHSA) · Jul 15, 2026
- RHSA-2026:25092 Red Hat Security Advisory: libsndfile security update Red Hat Security Advisories (RHSA) · Jul 15, 2026
- RHSA-2026:23223 Red Hat Security Advisory: libsndfile security update Red Hat Security Advisories (RHSA) · Jul 15, 2026
- RHSA-2026:23221 Red Hat Security Advisory: libsndfile security update Red Hat Security Advisories (RHSA) · Jul 15, 2026
- RHSA-2026:23222 Red Hat Security Advisory: libsndfile security update Red Hat Security Advisories (RHSA) · Jul 15, 2026
- RHSA-2026:19610 Red Hat Security Advisory: libsndfile security update Red Hat Security Advisories (RHSA) · Jul 15, 2026
- RHSA-2026:19559 Red Hat Security Advisory: libsndfile security update Red Hat Security Advisories (RHSA) · Jul 15, 2026
- RHSA-2026:19560 Red Hat Security Advisory: libsndfile security update Red Hat Security Advisories (RHSA) · Jul 15, 2026
- ELSA-2026-19610 Important: libsndfile security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jun 23, 2026
- RLSA-2026:19560 Important: libsndfile security update Rocky Linux Security Advisories · May 29, 2026
- RLSA-2026:19610 Important: libsndfile security update Rocky Linux Security Advisories · May 28, 2026
- RLSA-2026:19559 Important: libsndfile security update Rocky Linux Security Advisories · May 21, 2026
- ELSA-2026-19559 Important: libsndfile security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 21, 2026
- openSUSE-SU-2026:10730-1 libsndfile-devel-1.2.2-5.1 on GA media SUSE / openSUSE Security Updates · May 9, 2026