An issue was discovered in libsndfile 1.2.2 IMA ADPCM codec. The AIFF code path (line 241) was fixed with (sf_count_t) cast, but the WAV code path (line 235) and close path (line 167) were not. When samplesperblock (int) * blocks (int) exceeds INT_MAX, the 32-bit multiplication overflows before being assigned to sf.frames (sf_count_t/int64). With samplesperblock=50000 and blocks=50000, the product 2500000000 overflows to -1794967296. This causes incorrect frame count leading to heap buffer overflow or denial of service. Both values come from the WAV file header and are attacker-controlled. This issue was discovered after an incomplete fix for CVE-2022-33065.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libsndfile-utilsUpgrade libsndfileUpgrade libsndfile-devel | May 24, 2026 | May 20, 2026 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jul 2, 2026 | Jun 30, 2026 |
| Oracle_linux | — | Upgrade libsndfile-utilsUpgrade libsndfile-develUpgrade libsndfile | May 28, 2026 | Apr 29, 2026 |
| Redhat_linux | — | No solution existsUpgrade libsndfileUpgrade libsndfile-develUpgrade libsndfile-utilsUpgrade libsndfile-debugsourceUpgrade libsndfile-debuginfoUpgrade libsndfile-utils-debuginfo | May 24, 2026 | Apr 29, 2026 |
| Rocky_linux | — | Upgrade libsndfile-utilsUpgrade libsndfileUpgrade libsndfile-debugsourceUpgrade libsndfile-develUpgrade libsndfile-debuginfoUpgrade libsndfile-utils-debuginfo | May 25, 2026 | May 21, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub