CVE-2026-109828 Details
Description
A vulnerability was found in libsndfile up to 1.2.2. This issue affects the function wavlike_subchunk_parse of the file src/wavlike.c of the component WAV Parsing. Performing a manipulation results in use of uninitialized variable. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
A vulnerability exists in libsndfile versions through 1.2.2 within the WAV parsing component. The issue arises in the function 'wavlike_subchunk_parse' in 'src/wavlike.c', where a manipulation can cause the use of an uninitialized variable. This flaw allows for remote exploitation, with the potential for information disclosure by leaking uninitialized stack memory into cue-point names, which can then be accessed through the public API.
A suggested fix is to modify the WAV parsing code to ensure that only the bytes actually read from the file are copied into the cue-point name, and to properly null-terminate the string.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 13, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/libsndfile/libsndfile/ | [email protected] | ProductSource CodeVendor |
| https://github.com/libsndfile/libsndfile/issues/1169 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://vuldb.com/cve/CVE-2026-109828 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1002209 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/417466 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/417466/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-453 | Insecure Default Variable Initialization | [email protected] |
| CWE-457 | Use of Uninitialized Variable | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| libsndfile | <= 1.2.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 13, 2026 | New CVE Received | [email protected] |