Heap Buffer Overflow in libsndfile's WAV Codec by Cunning Attackers
CVE-2026-37555

7.5HIGH

Key Information:

Vendor

libsndfile

Status
libsndfile
Vendor
CVE Published:
29 April 2026

What is CVE-2026-37555?

A vulnerability in libsndfile's IMA ADPCM codec affects the WAV code path. When the product of samplesperblock and blocks exceeds INT_MAX, it leads to a 32-bit integer overflow before being assigned to sf.frames. This miscalculation causes an incorrect frame count, which can result in a heap buffer overflow or denial of service. Attackers can exploit this vulnerability by manipulating the WAV file header to control the input values. This issue persists due to an incomplete fix from a prior vulnerability.

References

https://github.com/libsndfile/libsndfile/issues/833
https://github.com/libsndfile/libsndfile/commit/9a829113c...
https://gist.github.com/sgInnora/a5f5c19e4bf6f4fb74fab7b0...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.