An out-of-bounds read flaw was found in libsndfile's FLAC codec functionality. An attacker who is able to submit a specially crafted file (via tricking a user to open or otherwise) to an application linked with libsndfile and using the FLAC codec, could trigger an out-of-bounds read that would most likely cause a crash but could potentially leak memory information that could be used in further exploitation of other flaws.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libsndfile-develUpgrade libsndfile | May 13, 2022 | Mar 23, 2022 |
| Amazon Linux Ami 2 | — | Upgrade libsndfile-utilsUpgrade libsndfile-develUpgrade libsndfileUpgrade libsndfile-debuginfo | Mar 22, 2023 | Mar 23, 2022 |
| Amazon_linux_2023 | — | Upgrade libsndfile-debuginfoUpgrade libsndfile-utilsUpgrade libsndfile-utils-debuginfoUpgrade libsndfileUpgrade libsndfile-debugsourceUpgrade libsndfile-devel | Feb 17, 2025 | Apr 13, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Mar 23, 2022 |
| Centos_linux | — | Upgrade libsndfile-debuginfoUpgrade libsndfileUpgrade libsndfile-utils-debuginfoUpgrade libsndfile-debugsource | May 13, 2022 | Mar 23, 2022 |
| Debian | — | Upgrade libsndfile | Jun 28, 2022 | Mar 23, 2022 |
| Gentoo Linux | — | Upgrade media-libs/libsndfile. | Oct 2, 2023 | Mar 23, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade libsndfile-utils-help | Aug 2, 2022 | Mar 23, 2022 |
| Huawei Euleros 2_0_sp3 | — | Upgrade libsndfile | Oct 28, 2022 | Mar 23, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade libsndfile | Jun 17, 2022 | Mar 23, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade libsndfile-develUpgrade libsndfile | Jun 22, 2022 | Mar 23, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade libsndfile-utils-help | Jul 11, 2022 | Mar 23, 2022 |
| Oracle_linux | — | Upgrade libsndfile-develUpgrade libsndfile | May 18, 2022 | Apr 13, 2021 |
| Redhat_linux | — | Upgrade libsndfileUpgrade libsndfile-develUpgrade libsndfile-debugsourceUpgrade libsndfile-utils-debuginfoUpgrade libsndfile-debuginfoNo solution exists | May 13, 2022 | Mar 23, 2022 |
| Rocky_linux | — | Upgrade libsndfileUpgrade libsndfile-develUpgrade libsndfile-debugsourceUpgrade libsndfile-debuginfo | Mar 5, 2024 | Mar 23, 2022 |
| Suse | — | Upgrade libsndfile-develUpgrade libsndfile-32bitUpgrade libsndfile1Upgrade libsndfile1-32bitUpgrade libsndfile-progsUpgrade libsndfile | Jan 6, 2022 | Jan 5, 2022 |
| Ubuntu | — | Upgrade libsndfile1 (Ubuntu Pro)Upgrade libsndfile1Upgrade libsndfile1-dev (Ubuntu Pro)Upgrade sndfile-programsUpgrade sndfile-programs (Ubuntu Pro) | May 11, 2022 | Jan 5, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub