Linux Distros Unpatched Vulnerability : CVE-2026-111157

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SoX through 14.4.2 contains a heap out-of-bounds write vulnerability in lsxmsadpcmblockexpandi in src/adpcm.c, triggered by an odd samplesPerBlock value in the...

CVE-2026-111157

SoX through 14.4.2 contains a heap out-of-bounds write vulnerability in lsxmsadpcmblockexpandi in src/adpcm.c, triggered by an odd samplesPerBlock value in the WAV fmt chunk. Attackers can supply a crafted MS ADPCM WAV file to sox or any libsox consumer to write a partially controlled 16-bit samp...

CVE-2026-111157 SoX through 14.4.2 Heap Out-of-Bounds Write via MS ADPCM WAV Decoding

SoX through 14.4.2 contains a heap out-of-bounds write vulnerability in lsxmsadpcmblockexpandi in src/adpcm.c, triggered by an odd samplesPerBlock value in the WAV fmt chunk. Attackers can supply a crafted MS ADPCM WAV file to sox or any libsox consumer to write a partially controlled 16-bit samp...

CVE-2026-111157

The software SoX versions through 14.4.2 is vulnerable to a heap out-of-bounds write in the lsx_ms_adpcm_block_expand_i() function located in src/adpcm.c. This vulnerability is triggered when processing a WAV fmt chunk containing an odd samplesPerBlock value . An attacker can exploit this by supp...

CVE-2026-111157 SoX through 14.4.2 Heap Out-of-Bounds Write via MS ADPCM WAV Decoding

SoX through 14.4.2 contains a heap out-of-bounds write vulnerability in lsxmsadpcmblockexpandi in src/adpcm.c, triggered by an odd samplesPerBlock value in the WAV fmt chunk. Attackers can supply a crafted MS ADPCM WAV file to sox or any libsox consumer to write a partially controlled 16-bit samp...

CVE-2026-111157

SoX through 14.4.2 contains a heap out-of-bounds write vulnerability in lsxmsadpcmblockexpandi in src/adpcm.c, triggered by an odd samplesPerBlock value in the WAV fmt chunk. Attackers can supply a crafted MS ADPCM WAV file to sox or any libsox consumer to write a partially controlled 16-bit samp...

Astra Linux – Vulnerability in libsdl2

In SDL Simple DirectMediaLayer versions 2.x through 2.0.9, there is a heap-based buffer over-read issue in the FillIMAADPCMblock function, caused by an integer overflow in the IMAADPCMDecode function in the audio/SDLwave.c file...

Astra Linux – Vulnerability in freerdp3

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.0, a underflow of a sizet variable in the IMA-ADPCM and MS-ADPCM audio decoders led to a heap-buffer-overflow issue through the RDPSND audio channel. In libfreerdp/codec/dsp.c, the IMA-ADPCM and MS-ADPCM decode...

CentOS Linux 7 [TuxCare] Security Update: freerdp / freerdp-devel / freerdp-libs / libwinpr / libwinpr-devel Multiple Vulnerabilities (CENTOS7:CLSA-2026:1774028255)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1774028255 advisory. - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a sizet underflow in the IMA-ADPCM and MS-ADPCM audi...

Rocky Linux 9.6 [TuxCare] Security Update: libsndfile / libsndfile-devel / libsndfile-utils (ALMALINUX9.6:CLSA-2026:1780515309)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1780515309 advisory. - An issue was discovered in libsndfile 1.2.2 IMA ADPCM codec. The AIFF code path line 241 was fixed with sfcountt cast, but the WAV code...

Rocky Linux 9 [CIQ] Security Update: gstreamer1-plugins-bad-free / gstreamer1-plugins-bad-free-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_55865)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202655865 advisory. gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec IMA/DVI ADPCM decoder CVE-2026-19387 gstreamer:...

Rocky Linux 8 [CIQ] Security Update: gstreamer1-plugins-bad-free / gstreamer1-plugins-bad-free-debuginfo / etc (crlsa-2026_56521)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202656521 advisory. gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec IMA/DVI ADPCM decoder CVE-2026-19387 Tenable has extracted the preceding...

AlmaLinux 9.2 [TuxCare] Security Update: libsndfile / libsndfile-devel / libsndfile-utils (ALMALINUX9.2:CLSA-2026:1780592196)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1780592196 advisory. - An issue was discovered in libsndfile 1.2.2 IMA ADPCM codec. The AIFF code path line 241 was fixed with sfcountt cast, but the WAV code pat...

AlmaLinux 9.6 [TuxCare] Security Update: libsndfile / libsndfile-devel / libsndfile-utils (ALMALINUX9.6:CLSA-2026:1780515309)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1780515309 advisory. - An issue was discovered in libsndfile 1.2.2 IMA ADPCM codec. The AIFF code path line 241 was fixed with sfcountt cast, but the WAV code pat...

Rocky Linux 9.6 [TuxCare] Security Update: gstreamer1-plugins-bad-free / gstreamer1-plugins-bad-free-devel / etc (ALMALINUX9.6:CLSA-2026:1787237880)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787237880 advisory. - A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio...

AlmaLinux 9.6 [TuxCare] Security Update: gstreamer1-plugins-bad-free / gstreamer1-plugins-bad-free-devel / etc (ALMALINUX9.6:CLSA-2026:1787237880)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787237880 advisory. - A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio...

TencentOS Server 3: gstreamer1-plugins-bad-free (TSSA-2026:1028)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1028 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec IMA/DVI ADPCM decoder

A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes beyond the allocated output buffer. Thi...

gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec IMA/DVI ADPCM decoder

A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes beyond the allocated output buffer. Thi...

Astra Linux – Vulnerability in freerdp3

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, a malicious RDP server could cause the FreeRDP client to crash by sending audio data in IMA ADPCM format with an invalid initial step index value = 89. The invalid step index was read directly from the netwo...