CVE-2026-88386: Libsndfile libsndfile vulnerability
Published Sep 24, 2026
·Updated
libsndfile 1.2.2 contains a misaligned memory access issue in psfbinheaderreadf() while parsing WAV fmt chunks. A specially crafted WAV file can cause the function to cast an unaligned destination address to unsigned int and perform a 4-byte store. This results in undefined behavior leading to denial of service.
Affected Software
1 affected component
libsndfile libsndfile=1.2.2
Event History
Sep 24, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·09:18 PM
Description
Frequently Asked Questions
1
What input is required to trigger the issue?
An attacker needs to supply a specially crafted WAV file containing a malformed fmt chunk that is parsed by the affected code path.
2
What is the practical impact of successful exploitation?
The misaligned 4-byte memory store causes undefined behavior and can result in denial of service.