An out-of-bounds read flaw was found in libsndfile's FLAC codec functionality. An attacker who is able to submit a specially crafted file (via tricking a user to open or otherwise) to an application linked with libsndfile and using the FLAC codec, could trigger an out-of-bounds read that would most likely cause a crash but could potentially leak memory information that could be used in further exploitation of other flaws.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libsndfile-develUpgrade libsndfile | May 13, 2022 | Mar 23, 2022 |
| Amazon Linux Ami 2 | — | Upgrade libsndfile-debuginfoUpgrade libsndfileUpgrade libsndfile-develUpgrade libsndfile-utils | Mar 22, 2023 | Mar 23, 2022 |
| Amazon_linux_2023 | — | Upgrade libsndfile-develUpgrade libsndfile-utils-debuginfoUpgrade libsndfile-debugsourceUpgrade libsndfileUpgrade libsndfile-utilsUpgrade libsndfile-debuginfo | Feb 17, 2025 | Apr 13, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Mar 23, 2022 |
| Centos_linux | — | Upgrade libsndfileUpgrade libsndfile-debuginfoUpgrade libsndfile-debugsourceUpgrade libsndfile-utils-debuginfo | May 13, 2022 | Mar 23, 2022 |
| Debian | — | Upgrade libsndfile | Jun 28, 2022 | Mar 23, 2022 |
| Gentoo Linux | — | Upgrade media-libs/libsndfile. | Oct 2, 2023 | Mar 23, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade libsndfile-utils-help | Aug 2, 2022 | Mar 23, 2022 |
| Huawei Euleros 2_0_sp3 | — | Upgrade libsndfile | Oct 28, 2022 | Mar 23, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade libsndfile | Jun 17, 2022 | Mar 23, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade libsndfile-develUpgrade libsndfile | Jun 22, 2022 | Mar 23, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade libsndfile-utils-help | Jul 11, 2022 | Mar 23, 2022 |
| Oracle_linux | — | Upgrade libsndfileUpgrade libsndfile-devel | May 18, 2022 | Apr 13, 2021 |
| Redhat_linux | — | No solution existsUpgrade libsndfile-debuginfoUpgrade libsndfileUpgrade libsndfile-debugsourceUpgrade libsndfile-develUpgrade libsndfile-utils-debuginfo | May 13, 2022 | Mar 23, 2022 |
| Rocky_linux | — | Upgrade libsndfile-debuginfoUpgrade libsndfile-debugsourceUpgrade libsndfileUpgrade libsndfile-devel | Mar 5, 2024 | Mar 23, 2022 |
| Suse | — | Upgrade libsndfile1-32bitUpgrade libsndfileUpgrade libsndfile-progsUpgrade libsndfile1Upgrade libsndfile-develUpgrade libsndfile-32bit | Jan 6, 2022 | Jan 5, 2022 |
| Ubuntu | — | Upgrade libsndfile1 (Ubuntu Pro)Upgrade sndfile-programsUpgrade libsndfile1Upgrade libsndfile1-dev (Ubuntu Pro)Upgrade sndfile-programs (Ubuntu Pro) | May 11, 2022 | Jan 5, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub