CVE-2026-88386: Medium severity libsndfile libsndfile vulnerability
Published Sep 24, 2026
·Updated
libsndfile 1.2.2 contains a misaligned memory access issue in psfbinheaderreadf() while parsing WAV fmt chunks. A specially crafted WAV file can cause the function to cast an unaligned destination address to unsigned int and perform a 4-byte store. This results in undefined behavior leading to denial of service.
Affected Software
2 affected componentsFixes available
libsndfile libsndfile=1.2.2
Microsoft azl3 libsndfile 1.2.2-5<1.2.2-6
1.2.2-6
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.2.2-6
Event History
Sep 24, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·09:18 PM
DescriptionSeverityWeakness
Oct 9, 2026
Data Sourced
via Microsoft·08:33 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What input is required to trigger the issue?
An attacker needs to supply a specially crafted WAV file containing a malformed fmt chunk that is parsed by the affected code path.
2
What is the practical impact of successful exploitation?
The misaligned 4-byte memory store causes undefined behavior and can result in denial of service.