CVE-2026-111157

The software SoX versions through 14.4.2 is vulnerable to a heap out-of-bounds write in the lsx_ms_adpcm_block_expand_i() function located in src/adpcm.c. This vulnerability is triggered when processing a WAV fmt chunk containing an odd samplesPerBlock value . An attacker can exploit this by supp...