Log in Start free

Vulnerability · Published Oct 13, 2026 · Assigned by VulDB

CVE-2026-109828libsndfile WAV Parsing wavlike.c wavlike_subchunk_parse uninitialized variable

Medium 4.3

In plain English

A medium-severity security flaw in libsndfile. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.3%top 77.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was found in libsndfile up to 1.2.2. This issue affects the function wavlike_subchunk_parse of the file src/wavlike.c of the component WAV Parsing. Performing a manipulation results in use of uninitialized variable. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libsndfileno fix listedDEBIAN-CVE-2026-109828
Debian:13libsndfileno fix listedDEBIAN-CVE-2026-109828
Debian:14libsndfileno fix listedDEBIAN-CVE-2026-109828
Ubuntu:22.04:LTSlibsndfileno fix listedUBUNTU-CVE-2026-109828
Ubuntu:24.04:LTSlibsndfileno fix listedUBUNTU-CVE-2026-109828
Ubuntu:26.04:LTSlibsndfileno fix listedUBUNTU-CVE-2026-109828
Ubuntu:26.10libsndfileno fix listedUBUNTU-CVE-2026-109828

Affected products (as reported)

VendorProductVersions
n/a libsndfile 1.2.01.2.11.2.2

Weakness: CWE-457, CWE-453 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C

References