Memory Access Issue in libsndfile Affects WAV File Parsing

CVE-2026-88386

What is CVE-2026-88386?

The libsndfile library version 1.2.2 contains a vulnerability that occurs during the parsing of WAV fmt chunks in the psf_binheader_readf() function. This misaligned memory access can be triggered by specially crafted WAV files, which lead to an unaligned destination address being cast to unsigned int *. When a 4-byte store operation occurs in this state, it results in undefined behavior, potentially leading to a denial of service. This vulnerability highlights the importance of ensuring proper memory alignment when dealing with audio file formats.

References