CVE-2026-129264: sox_ng VOC Decoder voc.c read_samples_voc out-of-bounds write
A security vulnerability has been detected in soxng up to 14.8.1. Affected by this issue is the function readsamplesvoc of the file src/voc.c of the component VOC Decoder. Such manipulation leads to out-of-bounds write. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The name of the patch is 0b40408b. A patch should be applied to remediate this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 0b40408b
Event History
Frequently Asked Questions
Which deployments are affected?
sox_ng versions up to 14.8.1 are affected when using the VOC Decoder component. The vulnerable code is read_samples_voc in src/voc.c.
What conditions are indicated for exploitation?
The issue can be exploited remotely through manipulation involving the VOC decoder. The supplied severity vector indicates low privileges and user interaction are required.
Is public exploitation information available?
Yes. The exploit has been publicly disclosed and may be used.
What remediation is identified?
Apply the vendor patch identified as 0b40408b. The vendor also released a fixed version, although its version number is not provided here.