OESA-2026-4562: libsndfile security update

Q: Who is exposed to this issue?

Systems using the affected libsndfile package are exposed when they process WAV files, particularly WAV files obtained from untrusted sources. The vulnerability can be triggered during parsing of a WAV fmt chunk.

Q: What does an attacker need to exploit it?

An attacker needs to provide a specially crafted WAV file and have it processed by libsndfile. The listed vector indicates local access, no privileges required, and user interaction required.

Q: What is the expected impact?

Successful exploitation can cause undefined behavior due to a misaligned 4-byte memory store, leading to denial of service. No confidentiality or integrity impact is listed.

Published Oct 29, 2026

Updated

Libsndfile is a C library for reading and writing files containing sampled sound such as MS Windows WAV and the Apple/SGI AIFF format through one standard library interface. Security Fix(es):

libsndfile 1.2.2 contains a misaligned memory access issue in psfbinheaderreadf() while parsing WAV fmt chunks. A specially crafted WAV file can cause the function to cast an unaligned destination address to unsigned int and perform a 4-byte store. This results in undefined behavior leading to denial of service.(CVE-2026-88386)

Affected Software

1 affected componentFixes available

openeuler/libsndfile<1.2.2-7.oe2403sp3

1.2.2-7.oe2403sp3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade openeuler/libsndfile to a version that resolves this vulnerability.
Fixed in 1.2.2-7.oe2403sp3

Event History

Oct 29, 2026

Advisory Published

via OSV·09:02 AM

Data Sourced

via OSV·09:02 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-88386

Frequently Asked Questions

Who is exposed to this issue?

Systems using the affected libsndfile package are exposed when they process WAV files, particularly WAV files obtained from untrusted sources. The vulnerability can be triggered during parsing of a WAV fmt chunk.

What does an attacker need to exploit it?

An attacker needs to provide a specially crafted WAV file and have it processed by libsndfile. The listed vector indicates local access, no privileges required, and user interaction required.

What is the expected impact?

Successful exploitation can cause undefined behavior due to a misaligned 4-byte memory store, leading to denial of service. No confidentiality or integrity impact is listed.

OESA-2026-4562: libsndfile security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the expected impact?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the expected impact?