OESA-2026-4661: libsndfile security update
Libsndfile is a C library for reading and writing files containing sampled sound such as MS Windows WAV and the Apple/SGI AIFF format through one standard library interface. Security Fix(es):
libsndfile 1.2.2 contains an integer overflow vulnerability in mat4readheader() when parsing crafted MAT4 (MATLAB v4) files.(CVE-2026-88372)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/libsndfileto a version that resolves this vulnerability.Fixed in 1.2.2-8.oe2403sp3
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using libsndfile 1.2.2 that parse MATLAB v4 (MAT4) audio files are exposed to the vulnerable code path. Systems that do not process MAT4 files are not described as reaching the affected mat4_read_header() parser.
What would an attacker need to exploit the vulnerability?
An attacker would need to cause the target to parse a crafted MAT4 file. The supplied CVSS vector indicates network exploitation with low complexity, no privileges, and no user interaction.
What is the expected impact if exploitation succeeds?
The reported integer overflow has a high availability impact. The supplied vector reports no confidentiality or integrity impact.