Astra Linux – Vulnerability in libsndfile

A heap buffer overflow vulnerability in the msadpcmDecodeBlock function of libsndfile 1.0.30 allows attackers to execute arbitrary code through a crafted WAV file...

CVE-2026-19387

A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes beyond the allocated output buffer. Thi...

libsndfile: integer overflow in ima_reader_init()

A flaw was found in the libsndfile library. An integer overflow in the IMA ADPCM codec can occur when a specially crafted WAV audio file is processed, specifically with malicious samplesperblock and blocks values. This can lead to a heap-based buffer overflow, causing a crash to the application...

TagLib DoS

The vulnerability of the library for working with TagLib audio metadata is related to pointer assignment errors. Exploiting this vulnerability can allow an attacker to trigger a service failure using a specially created WAV file...

Unity Linux 20.1060e / 20.1070e Security Update: libsndfile (UTSA-2026-017615)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017615 advisory. A heap buffer overflow vulnerability in msadpcmdecodeblock of libsndfile 1.0.30 allows attackers to execute arbitrary code via a crafted WAV file. Tenable has...

CLSA-2026-1777540469 taglib: Fix of CVE-2023-47466

CVE-2023-47466: Fix segmentation violation and application crash during tag writing via crafted WAV file...

UBUNTU-CVE-2025-70309

A stack overflow in the pcmreframeflushpacket function of GPAC v2.4.0 allows attackers to cause a Denial of Service DoS via a crafted WAV file...

CVE-2025-70309

A stack overflow in the pcmreframeflushpacket function of GPAC v2.4.0 allows attackers to cause a Denial of Service DoS via a crafted WAV file...

CVE-2025-70309

The open-source multimedia framework GPAC v2.4.0 contains a stack buffer overflow vulnerability in the pcmreframe_flush_packet function. This flaw arises because the function fails to properly validate the length and size of the input data. An attacker can exploit this by providing a crafted WAV ...

CVE-2025-70309

A stack overflow in the pcmreframeflushpacket function of GPAC v2.4.0 allows attackers to cause a Denial of Service DoS via a crafted WAV file...

EUVD-2022-55929

SoX 14.4.2 contains a division by zero vulnerability when handling WAV files that can cause program crashes. Attackers can trigger a floating point exception by providing a specially crafted WAV file that causes arithmetic errors during sound file processing...

CVE-2022-50798

Removed by vendor...

CVE-2022-50798

CVE-2022-50798 is associated with SoX 14.4.2 and is described in multiple advisories as a division-by-zero fault when processing WAV files, potentially causing program crashes. Connected docs indicate the vulnerability affects SoX 14.4.2 and provide remediation guidance via package updates (e.g.,...

Number withdrawal

SoX is a suite of open source audio processing tools. The product supports playing, converting and recording audio in multiple formats. A numeric error vulnerability exists in SoX version 14.4.2, which originates from a divide-by-zero error when processing a specially crafted WAV file, and may...

Speex read_samples() DoS

The vulnerability of the readsamples function in the Speex audio codec is related to division by zero. Exploiting this vulnerability could allow an attacker to cause a service failure through the use of a specially crafted WAV file...

Linux Distros Unpatched Vulnerability : CVE-2023-35964

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Multiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115. A specially crafted wave file can lead to arbitrary...

Linux Distros Unpatched Vulnerability : CVE-2023-35961

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Multiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115. A specially crafted wave file can lead to arbitrary...

Linux Distros Unpatched Vulnerability : CVE-2017-9130

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The faacEncOpen function in libfaac/frame.c in Freeware Advanced Audio Coder FAAC 1.28 allows remote attackers to cause a denial of service invalid memory read...

CLSA-2025-1754552791 taglib: Fix of CVE-2023-47466

CVE-2023-47466: Fix segmentation violation and application crash during tag writing via crafted WAV file...

OESA-2025-1638 taglib security update

TagLib is a library for reading and editing the meta-data of several popular audio formats. Currently it supports both ID3v1 and ID3v2 for MP3 files, Ogg Vorbis comments and ID3 tags and Vorbis comments in FLAC, MPC, Speex, WavPack TrueAudio, WAV, AIFF, MP4 and ASF files. Security Fixes: TagLib...