Low
libsndfile — security advisory
A vulnerability was found in libsndfile up to 1.2.2. This issue affects the function wavlike_subchunk_parse of the file src/wavlike.c of the component WAV Parsing. Performing a manipulation results in use of uninitialized variable. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
- Products
- libsndfile
- Affected versions
- 1.2.0-1, 1.2.0-1+deb12u1, 1.2.2-1, 1.2.2-1+hurd.1, 1.2.2-1+hurd.2, 1.2.2-1+hurd.3, 1.2.2-2, 1.2.2-2+deb13u1, 1.2.2-3, 1.2.2-4
- Fixed versions
- Not specified
- CVEs
- CVE-2026-109828
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 30 Oct 2026, 12:13 UTC · Revision 1
Source evidence
A vulnerability was found in libsndfile up to 1.2.2. This issue affects the function wavlike_subchunk_parse of the file src/wavlike.c of the component WAV Parsing. Performing a manipulation results in use of uninitialized variable. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
osv:DEBIAN-CVE-2026-109828
libsndfile
Fixed versions: Not specified
libsndfile
Fixed versions: Not specified
libsndfile
Fixed versions: Not specified
Complete source record
{
"id": "2393946815a5bece955709509106d6c7e2905864c80a5570e18977d1dcbeb473",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2026-109828",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2026-109828",
"summary": "A vulnerability was found in libsndfile up to 1.2.2. This issue affects the function wavlike_subchunk_parse of the file src/wavlike.c of the component WAV Parsing. Performing a manipulation results in use of uninitialized variable. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.",
"evidence": "osv:DEBIAN-CVE-2026-109828",
"products": [
{
"name": {
"value": "libsndfile",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.2.0-1",
"evidence": "/affected/0/versions"
},
{
"value": "1.2.0-1+deb12u1",
"evidence": "/affected/0/versions"
},
{
"value": "1.2.2-1",
"evidence": "/affected/0/versions"
},
{
"value": "1.2.2-1+hurd.1",
"evidence": "/affected/0/versions"
},
{
"value": "1.2.2-1+hurd.2",
"evidence": "/affected/0/versions"
},
{
"value": "1.2.2-1+hurd.3",
"evidence": "/affected/0/versions"
},
{
"value": "1.2.2-2",
"evidence": "/affected/0/versions"
},
{
"value": "1.2.2-3",
"evidence": "/affected/0/versions"
},
{
"value": "1.2.2-4",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "libsndfile",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.2.2-2",
"evidence": "/affected/1/versions"
},
{
"value": "1.2.2-2+deb13u1",
"evidence": "/affected/1/versions"
},
{
"value": "1.2.2-3",
"evidence": "/affected/1/versions"
},
{
"value": "1.2.2-4",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "libsndfile",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.2.2-2",
"evidence": "/affected/2/versions"
},
{
"value": "1.2.2-3",
"evidence": "/affected/2/versions"
},
{
"value": "1.2.2-4",
"evidence": "/affected/2/versions"
}
]
}
],
"severity": "low",
"structured": {
"id": "DEBIAN-CVE-2026-109828",
"aliases": [
"DEBIAN-CVE-2026-109828"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libsndfile",
"purl": "pkg:deb/debian/libsndfile?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"1.2.0-1",
"1.2.0-1+deb12u1",
"1.2.2-1",
"1.2.2-1+hurd.1",
"1.2.2-1+hurd.2",
"1.2.2-1+hurd.3",
"1.2.2-2",
"1.2.2-3",
"1.2.2-4"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-109828.json"
},
"ecosystem_specific": {
"urgency": "unimportant"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libsndfile",
"purl": "pkg:deb/debian/libsndfile?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"1.2.2-2",
"1.2.2-2+deb13u1",
"1.2.2-3",
"1.2.2-4"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-109828.json"
},
"ecosystem_specific": {
"urgency": "unimportant"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libsndfile",
"purl": "pkg:deb/debian/libsndfile?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"1.2.2-2",
"1.2.2-3",
"1.2.2-4"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-109828.json"
},
"ecosystem_specific": {
"urgency": "unimportant"
}
}
],
"modified": "2026-10-14T14:00:06.065912148Z",
"provider": "osv",
"upstream": [
"CVE-2026-109828"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2026-109828"
]
},
"related_cves": [
{
"value": "CVE-2026-109828",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 316316,
"published_at": "2026-10-13T17:17:31.893+00:00"
}