CVE-2026-109828

medium

Description

A vulnerability was found in libsndfile up to 1.2.2. This issue affects the function wavlike_subchunk_parse of the file src/wavlike.c of the component WAV Parsing. Performing a manipulation results in use of uninitialized variable. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

References

https://vuldb.com/vuln/417466/cti

https://vuldb.com/vuln/417466

https://vuldb.com/submit/1002209

https://vuldb.com/cve/CVE-2026-109828

https://github.com/libsndfile/libsndfile/issues/1169

https://github.com/libsndfile/libsndfile/

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-98900

Details

Source: Mitre, NVD

Published: 2026-10-13

Updated: 2026-10-13

Risk Information

CVSS v2

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

Severity: Medium

CVSS v3

Base Score: 4.3

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Severity: Medium

CVSS v4

Base Score: 5.3

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Severity: Medium