CVE-2018-13440: Null Pointer Dereference
Published Jul 8, 2018
·Updated
Last updated 25 August 2025
Other sources
The audiofile Audio File Library 0.3.6 has a NULL pointer dereference bug in ModuleState::setup in modules/ModuleState.cpp, which allows an attacker to cause a denial of service via a crafted caf file, as demonstrated by sfconvert.
— Launchpad
Affected Software
4 affected componentsFixes available
Audio File Library Project Audio File Library=0.3.6
Canonical Ubuntu Linux=14.04
Audiofile audiofile=0.3.6
debian/audiofile
0.3.6-50.3.6-5+deb11u10.3.6-5+deb12u10.3.6-7
Remediation
Event History
Jul 8, 2018
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Data Sourced
via NVD·04:29 PM
DescriptionSeverityWeaknessAffected Software
Jan 11, 2024
Data Sourced
via Launchpad·10:50 PM
Description
Aug 17, 2025
Data Sourced
via Debian·09:37 PM
DescriptionAffected Software
Sep 2, 2025
Data Sourced
via Ubuntu·09:38 PM
RemedyDescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2018-13440?
The severity of CVE-2018-13440 is classified as a denial of service vulnerability.
2
How do I fix CVE-2018-13440?
To fix CVE-2018-13440, update the affected software to versions 0.3.6-5 or higher.
3
Which software is affected by CVE-2018-13440?
CVE-2018-13440 affects the Audio File Library version 0.3.6 and specific versions of the Debian package audiofile.
4
Can CVE-2018-13440 be exploited remotely?
Yes, CVE-2018-13440 can be exploited remotely through crafted input files.
5
What type of attack does CVE-2018-13440 enable?
CVE-2018-13440 enables denial of service attacks due to a NULL pointer dereference.