An out-of-bounds read flaw was found in libsndfile's FLAC codec functionality. An attacker who is able to submit a specially crafted file (via tricking a user to open or otherwise) to an application linked with libsndfile and using the FLAC codec, could trigger an out-of-bounds read that would most likely cause a crash but could potentially leak memory information that could be used in further exploitation of other flaws.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libsndfile-develUpgrade libsndfile | May 13, 2022 | Mar 23, 2022 |
| Amazon Linux Ami 2 | — | Upgrade libsndfile-debuginfoUpgrade libsndfile-utilsUpgrade libsndfileUpgrade libsndfile-devel | Mar 22, 2023 | Mar 23, 2022 |
| Amazon_linux_2023 | — | Upgrade libsndfile-utilsUpgrade libsndfile-debuginfoUpgrade libsndfile-utils-debuginfoUpgrade libsndfile-debugsourceUpgrade libsndfileUpgrade libsndfile-devel | Feb 17, 2025 | Apr 13, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Mar 23, 2022 |
| Centos_linux | — | Upgrade libsndfile-debugsourceUpgrade libsndfile-utils-debuginfoUpgrade libsndfile-debuginfoUpgrade libsndfile | May 13, 2022 | Mar 23, 2022 |
| Debian | — | Upgrade libsndfile | Jun 28, 2022 | Mar 23, 2022 |
| Gentoo Linux | — | Upgrade media-libs/libsndfile. | Oct 2, 2023 | Mar 23, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade libsndfile-utils-help | Aug 2, 2022 | Mar 23, 2022 |
| Huawei Euleros 2_0_sp3 | — | Upgrade libsndfile | Oct 28, 2022 | Mar 23, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade libsndfile | Jun 17, 2022 | Mar 23, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade libsndfileUpgrade libsndfile-devel | Jun 22, 2022 | Mar 23, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade libsndfile-utils-help | Jul 11, 2022 | Mar 23, 2022 |
| Oracle_linux | — | Upgrade libsndfileUpgrade libsndfile-devel | May 18, 2022 | Apr 13, 2021 |
| Redhat_linux | — | No solution existsUpgrade libsndfile-debuginfoUpgrade libsndfile-utils-debuginfoUpgrade libsndfile-develUpgrade libsndfile-debugsourceUpgrade libsndfile | May 13, 2022 | Mar 23, 2022 |
| Rocky_linux | — | Upgrade libsndfile-develUpgrade libsndfileUpgrade libsndfile-debuginfoUpgrade libsndfile-debugsource | Mar 5, 2024 | Mar 23, 2022 |
| Suse | — | Upgrade libsndfile-develUpgrade libsndfile-32bitUpgrade libsndfileUpgrade libsndfile1Upgrade libsndfile1-32bitUpgrade libsndfile-progs | Jan 6, 2022 | Jan 5, 2022 |
| Ubuntu | — | Upgrade sndfile-programsUpgrade sndfile-programs (Ubuntu Pro)Upgrade libsndfile1-dev (Ubuntu Pro)Upgrade libsndfile1Upgrade libsndfile1 (Ubuntu Pro) | May 11, 2022 | Jan 5, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub