CVE-2018-13440: Null Pointer Dereference
Last updated 25 August 2025
Other sources
The audiofile Audio File Library 0.3.6 has a NULL pointer dereference bug in ModuleState::setup in modules/ModuleState.cpp, which allows an attacker to cause a denial of service via a crafted caf file, as demonstrated by sfconvert.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/audiofileto a version that resolves this vulnerability.Fixed in 0.3.6-5+deb12u1Fixed in 0.3.6-7
Event History
Frequently Asked Questions
What is the severity of CVE-2018-13440?
The severity of CVE-2018-13440 is classified as a denial of service vulnerability.
How do I fix CVE-2018-13440?
To fix CVE-2018-13440, update the affected software to versions 0.3.6-5 or higher.
Which software is affected by CVE-2018-13440?
CVE-2018-13440 affects the Audio File Library version 0.3.6 and specific versions of the Debian package audiofile.
Can CVE-2018-13440 be exploited remotely?
Yes, CVE-2018-13440 can be exploited remotely through crafted input files.
What type of attack does CVE-2018-13440 enable?
CVE-2018-13440 enables denial of service attacks due to a NULL pointer dereference.