Off-by-One Error in Libsndfile Affects Audio Processing Functionality
CVE-2022-33064

7.8HIGH

Key Information:

Vendor: Libsndfile Project
Status: Libsndfile
Vendor: CVE Published:; 18 July 2023

🔔 Create Libsndfile Project Vulnerability Alert

What is CVE-2022-33064?

A vulnerability exists in the audio processing library Libsndfile due to an off-by-one error in the wav_read_header function located in src/wav.c. This flaw can lead to out-of-bounds writes, allowing an attacker to potentially execute arbitrary code or cause a Denial of Service. This vulnerability highlights the importance of input validation and proper boundary checks in software development.

References

https://github.com/libsndfile/libsndfile/issues/832

CVSS V3.1

Score:

7.8

Severity:

HIGH

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Local

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jul 18, 2023
Vulnerability Reserved
Jun 13, 2022

CVE-2022-33064 Data

JSON