OESA-2026-4848: audiofile security update

Q: What must an attacker do to trigger the vulnerability?

An attacker needs to provide a crafted audio file that is processed by the affected Audio File Library code. Successful exploitation can cause the application to crash.

Q: Is user interaction required?

Yes. The severity vector indicates user interaction is required, so a user or application workflow must open or otherwise process the crafted file.

Q: What is the likely impact of exploitation?

The documented impact is denial of service through a crash caused by a heap-based buffer overflow. No confidentiality or integrity impact is indicated by the supplied severity vector.

Q: Which component should be checked for exposure?

Check systems using the openEuler audiofile package, particularly applications that process untrusted or externally supplied audio files with Audio File Library 0.3.6.

Published Nov 11, 2026

Updated

The Audio File Library is a C-based library for reading and writing audio files in many common formats. Security Fix(es):

Heap-based buffer overflow in the alaw2linearbuf function in G711.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service (crash) via a crafted file.(CVE-2017-6830)

Affected Software

1 affected componentFixes available

openeuler/audiofile<0.3.6-33.oe2403sp4

0.3.6-33.oe2403sp4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade openeuler/audiofile to a version that resolves this vulnerability.
Fixed in 0.3.6-33.oe2403sp4

Event History

Nov 11, 2026

Advisory Published

via OSV·12:26 PM

Data Sourced

via OSV·12:26 PM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2017-6830

Frequently Asked Questions

What must an attacker do to trigger the vulnerability?

An attacker needs to provide a crafted audio file that is processed by the affected Audio File Library code. Successful exploitation can cause the application to crash.

Is user interaction required?

Yes. The severity vector indicates user interaction is required, so a user or application workflow must open or otherwise process the crafted file.

What is the likely impact of exploitation?

The documented impact is denial of service through a crash caused by a heap-based buffer overflow. No confidentiality or integrity impact is indicated by the supplied severity vector.

Which component should be checked for exposure?

Check systems using the openEuler audiofile package, particularly applications that process untrusted or externally supplied audio files with Audio File Library 0.3.6.

OESA-2026-4848: audiofile security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What must an attacker do to trigger the vulnerability?

Is user interaction required?

What is the likely impact of exploitation?

Which component should be checked for exposure?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker do to trigger the vulnerability?

Is user interaction required?

What is the likely impact of exploitation?

Which component should be checked for exposure?