CVE-2026-111157: SoX through 14.4.2 Heap Out-of-Bounds Write via MS ADPCM WAV Decoding
SoX through 14.4.2 contains a heap out-of-bounds write vulnerability in lsxmsadpcmblockexpandi() in src/adpcm.c, triggered by an odd samplesPerBlock value in the WAV fmt chunk. Attackers can supply a crafted MS ADPCM WAV file to sox or any libsox consumer to write a partially controlled 16-bit sample past the heap buffer allocated by wavmsadpcmfmt().
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems that process attacker-supplied MS ADPCM WAV files with SoX through 14.4.2, or with another application that uses libsox, are exposed. Exploitation requires the crafted file to be passed to the decoder.
What attacker interaction is required?
The attacker needs to provide a specially crafted MS ADPCM WAV file with an odd samplesPerBlock value in its WAV fmt chunk. The affected user or application must then process that file with SoX or a libsox consumer.
What is the impact of successful exploitation?
Processing the file can write a partially controlled 16-bit sample beyond a heap buffer allocated during WAV MS ADPCM format handling. The supplied severity vector indicates local attack access, no privileges required, user interaction required, no confidentiality impact, low integrity impact, and high availability impact.