Integer Overflow Vulnerability in Libsndfile Affects Audio Processing
CVE-2022-33065

7.8HIGH

Key Information:

Vendor

Libsndfile Project

Status
Libsndfile
Vendor
CVE Published:
18 July 2023

What is CVE-2022-33065?

Libsndfile contains multiple signed integer overflow vulnerabilities in key functions responsible for processing audio files. Specifically, issues are found in au_read_header in src/au.c and in mat4_open and mat4_read_header within src/mat4.c. Exploiting these vulnerabilities can lead to a Denial of Service condition and potentially other unspecified impacts, posing a significant risk to users relying on this audio processing library.

References

https://github.com/libsndfile/libsndfile/issues/833
https://github.com/libsndfile/libsndfile/issues/789

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.