OESA-2026-4564: libsndfile security update

Q: Who is exposed to this issue?

Systems using the openEuler libsndfile package are exposed when they process WAV files. Exploitation requires a user or application to supply a specially crafted WAV file for parsing.

Q: What is the practical impact of successful exploitation?

The issue can cause undefined behavior during WAV fmt chunk parsing and lead to a denial of service. The available data does not indicate confidentiality or integrity impact.

Q: Does exploitation require prior access or elevated privileges?

The provided vector indicates no privileges are required, but user interaction is required. The attack is local and depends on getting a crafted WAV file processed.

Published Oct 29, 2026

Updated

Libsndfile is a C library for reading and writing files containing sampled sound such as MS Windows WAV and the Apple/SGI AIFF format through one standard library interface. Security Fix(es):

libsndfile 1.2.2 contains a misaligned memory access issue in psfbinheaderreadf() while parsing WAV fmt chunks. A specially crafted WAV file can cause the function to cast an unaligned destination address to unsigned int and perform a 4-byte store. This results in undefined behavior leading to denial of service.(CVE-2026-88386)

Affected Software

1 affected componentFixes available

openeuler/libsndfile<1.0.31-7.oe2203sp4

1.0.31-7.oe2203sp4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade openeuler/libsndfile to a version that resolves this vulnerability.
Fixed in 1.0.31-7.oe2203sp4

Event History

Oct 29, 2026

Advisory Published

via OSV·09:02 AM

Data Sourced

via OSV·09:02 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-88386

Frequently Asked Questions

Who is exposed to this issue?

Systems using the openEuler libsndfile package are exposed when they process WAV files. Exploitation requires a user or application to supply a specially crafted WAV file for parsing.

What is the practical impact of successful exploitation?

The issue can cause undefined behavior during WAV fmt chunk parsing and lead to a denial of service. The available data does not indicate confidentiality or integrity impact.

Does exploitation require prior access or elevated privileges?

The provided vector indicates no privileges are required, but user interaction is required. The attack is local and depends on getting a crafted WAV file processed.

OESA-2026-4564: libsndfile security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who is exposed to this issue?

What is the practical impact of successful exploitation?

Does exploitation require prior access or elevated privileges?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What is the practical impact of successful exploitation?

Does exploitation require prior access or elevated privileges?