CVE-2026-37555: [CVE-2026-37555] libsndfile IMA-ADPCM integer overflow (incomplete fix for CVE-2022-33065)
An issue was discovered in libsndfile 1.2.2 IMA ADPCM codec. The AIFF code path (line 241) was fixed with (sfcountt) cast, but the WAV code path (line 235) and close path (line 167) were not. When samplesperblock (int) blocks (int) exceeds INTMAX, the 32-bit multiplication overflows before being assigned to sf.frames (sfcountt/int64). With samplesperblock=50000 and blocks=50000, the product 2500000000 overflows to -1794967296. This causes incorrect frame count leading to heap buffer overflow or denial of service. Both values come from the WAV file header and are attacker-controlled. This issue was discovered after an incomplete fix for CVE-2022-33065.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.2.2-5 - Upgrade
Upgrade
libsndfileto a version that resolves this vulnerability.Fixed in 1.2.2Patch CVE-2026-37555
Event History
Frequently Asked Questions
What is the severity of CVE-2026-37555?
CVE-2026-37555 has a high severity rating due to the potential for integer overflow leading to denial of service.
How do I fix CVE-2026-37555?
To mitigate CVE-2026-37555, update libsndfile to a version where the integer overflow on WAV and close path is properly addressed.
Which versions of libsndfile are affected by CVE-2026-37555?
CVE-2026-37555 specifically affects libsndfile version 1.2.2.
What types of attacks could exploit CVE-2026-37555?
Exploitation of CVE-2026-37555 could lead to denial of service conditions when processing maliciously crafted AIFF or WAV files.
Is CVE-2026-37555 an incomplete fix for a previous vulnerability?
Yes, CVE-2026-37555 is an incomplete fix for CVE-2022-33065, where similar vulnerabilities were not fully addressed.