CVE-2026-109828: libsndfile WAV Parsing wavlike.c wavlike_subchunk_parse uninitialized variable
A vulnerability was found in libsndfile up to 1.2.2. This issue affects the function wavlikesubchunkparse of the file src/wavlike.c of the component WAV Parsing. Performing a manipulation results in use of uninitialized variable. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Which deployments are in scope?
The issue affects libsndfile versions up to and including 1.2.2. The affected code is in the WAV parsing component, so systems that process WAV input with an affected libsndfile build are the relevant exposure surface.
What would an attacker need to exploit this?
The published severity vector indicates network reachability, low attack complexity, no required privileges, and user interaction. Exploitation involves manipulated input and may be possible remotely when a user or application processes that input.
How mature is the exploitation risk?
An exploit has been made public and could be used. Treat externally supplied WAV files as potentially hostile in affected environments.
Is a fixed release or workaround identified?
The provided information does not identify a fixed version or a vendor workaround. It states that the project was notified through an issue report but had not responded at the time of publication.