Log in Start free

Vulnerability · Published Mar 23, 2022 · Assigned by redhat

CVE-2021-4156

High 7.1

In plain English

A high-severity out-of-bounds read in libsndfile. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 78% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.1High
Exploit odds (30 days)1.8%top 22.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

An out-of-bounds read flaw was found in libsndfile's FLAC codec functionality. An attacker who is able to submit a specially crafted file (via tricking a user to open or otherwise) to an application linked with libsndfile and using the FLAC codec, could trigger an out-of-bounds read that would most likely cause a crash but could potentially leak memory information that could be used in further exploitation of other flaws.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8libsndfile1.0.28-12.el8ALSA-2022:1968
AlmaLinux:8libsndfile-devel1.0.28-12.el8ALSA-2022:1968
Debian:12libsndfile1.1.0-1DEBIAN-CVE-2021-4156
Debian:13libsndfile1.1.0-1DEBIAN-CVE-2021-4156
Debian:14libsndfile1.1.0-1DEBIAN-CVE-2021-4156
Rocky Linux:8libsndfile0:1.0.28-12.el8RLSA-2022:1968
Ubuntu:22.04:LTSlibsndfile1.0.31-2ubuntu0.2USN-7273-1
Ubuntu:22.04:LTSlibsndfile1.0.31-2ubuntu0.2UBUNTU-CVE-2021-4156

Affected products (as reported)

VendorProductVersions
n/a libsndfile libsndfile 1.1.0

Weakness: CWE-125

References