OESA-2026-4662: libsndfile security update
Libsndfile is a C library for reading and writing files containing sampled sound such as MS Windows WAV and the Apple/SGI AIFF format through one standard library interface. Security Fix(es):
libsndfile 1.2.2 contains an integer overflow vulnerability in mat4readheader() when parsing crafted MAT4 (MATLAB v4) files.(CVE-2026-88372)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/libsndfileto a version that resolves this vulnerability.Fixed in 1.2.2-8.oe2403sp1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the openEuler libsndfile package may be exposed when they process crafted MATLAB v4 (MAT4) audio files through libsndfile. The issue is remotely reachable according to the supplied vector and does not require authentication or user interaction.
What does an attacker need to exploit it?
An attacker needs to cause a vulnerable libsndfile instance to parse a specially crafted MAT4 file. Exploitation is associated with an integer overflow in the mat4_read_header() function and can result in a denial of service.
What is the likely impact?
The provided severity vector indicates high availability impact, with no stated confidentiality or integrity impact. A successful attack may make the affected application or service unavailable.