An out-of-bounds read flaw was found in libsndfile's FLAC codec functionality. An attacker who is able to submit a specially crafted file (via tricking a user to open or otherwise) to an application linked with libsndfile and using the FLAC codec, could trigger an out-of-bounds read that would most likely cause a crash but could potentially leak memory information that could be used in further exploitation of other flaws.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libsndfileUpgrade libsndfile-devel | May 13, 2022 | Mar 23, 2022 |
| Amazon Linux Ami 2 | — | Upgrade libsndfile-utilsUpgrade libsndfileUpgrade libsndfile-develUpgrade libsndfile-debuginfo | Mar 22, 2023 | Mar 23, 2022 |
| Amazon_linux_2023 | — | Upgrade libsndfile-develUpgrade libsndfileUpgrade libsndfile-debugsourceUpgrade libsndfile-utils-debuginfoUpgrade libsndfile-utilsUpgrade libsndfile-debuginfo | Feb 17, 2025 | Apr 13, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Mar 23, 2022 |
| Centos_linux | — | Upgrade libsndfile-debuginfoUpgrade libsndfileUpgrade libsndfile-debugsourceUpgrade libsndfile-utils-debuginfo | May 13, 2022 | Mar 23, 2022 |
| Debian | — | Upgrade libsndfile | Jun 28, 2022 | Mar 23, 2022 |
| Gentoo Linux | — | Upgrade media-libs/libsndfile. | Oct 2, 2023 | Mar 23, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade libsndfile-utils-help | Aug 2, 2022 | Mar 23, 2022 |
| Huawei Euleros 2_0_sp3 | — | Upgrade libsndfile | Oct 28, 2022 | Mar 23, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade libsndfile | Jun 17, 2022 | Mar 23, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade libsndfile-develUpgrade libsndfile | Jun 22, 2022 | Mar 23, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade libsndfile-utils-help | Jul 11, 2022 | Mar 23, 2022 |
| Oracle_linux | — | Upgrade libsndfileUpgrade libsndfile-devel | May 18, 2022 | Apr 13, 2021 |
| Redhat_linux | — | Upgrade libsndfileUpgrade libsndfile-debugsourceUpgrade libsndfile-develUpgrade libsndfile-utils-debuginfoUpgrade libsndfile-debuginfoNo solution exists | May 13, 2022 | Mar 23, 2022 |
| Rocky_linux | — | Upgrade libsndfile-debuginfoUpgrade libsndfile-debugsourceUpgrade libsndfile-develUpgrade libsndfile | Mar 5, 2024 | Mar 23, 2022 |
| Suse | — | Upgrade libsndfile1Upgrade libsndfile-progsUpgrade libsndfile1-32bitUpgrade libsndfileUpgrade libsndfile-develUpgrade libsndfile-32bit | Jan 6, 2022 | Jan 5, 2022 |
| Ubuntu | — | Upgrade libsndfile1 (Ubuntu Pro)Upgrade sndfile-programsUpgrade sndfile-programs (Ubuntu Pro)Upgrade libsndfile1Upgrade libsndfile1-dev (Ubuntu Pro) | May 11, 2022 | Jan 5, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub