Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.2
libsndfile: Uncontrolled Memory Access via Malicious Audio Files
published 4 months ago
Summary
A security issue affects libsndfile, a library used to read and write audio files. If exploited, this issue could allow an attacker to execute arbitrary code on a system. To protect your system, update libsndfile to the latest version.
What to do
- Update redhat libsndfile to version 0:1.0.28-14.el8_8.
- Update redhat libsndfile-debuginfo to version 0:1.0.28-14.el8_8.
- Update redhat libsndfile-debugsource to version 0:1.0.28-14.el8_8.
- Update redhat libsndfile-utils to version 0:1.0.28-14.el8_8.
- Update redhat libsndfile-utils-debuginfo to version 0:1.0.28-14.el8_8.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Red Hat:rhel_e4s:8.8::appstream | redhat | libsndfile |
< 0:1.0.28-14.el8_8 Fix: upgrade to 0:1.0.28-14.el8_8
|
| Red Hat:rhel_e4s:8.8::appstream | redhat | libsndfile-debuginfo |
< 0:1.0.28-14.el8_8 Fix: upgrade to 0:1.0.28-14.el8_8
|
| Red Hat:rhel_e4s:8.8::appstream | redhat | libsndfile-debugsource |
< 0:1.0.28-14.el8_8 Fix: upgrade to 0:1.0.28-14.el8_8
|
| Red Hat:rhel_e4s:8.8::appstream | redhat | libsndfile-utils |
< 0:1.0.28-14.el8_8 Fix: upgrade to 0:1.0.28-14.el8_8
|
| Red Hat:rhel_e4s:8.8::appstream | redhat | libsndfile-utils-debuginfo |
< 0:1.0.28-14.el8_8 Fix: upgrade to 0:1.0.28-14.el8_8
|
| Red Hat:rhel_tus:8.8::appstream | redhat | libsndfile |
< 0:1.0.28-14.el8_8 Fix: upgrade to 0:1.0.28-14.el8_8
|
| Red Hat:rhel_tus:8.8::appstream | redhat | libsndfile-debuginfo |
< 0:1.0.28-14.el8_8 Fix: upgrade to 0:1.0.28-14.el8_8
|
| Red Hat:rhel_tus:8.8::appstream | redhat | libsndfile-debugsource |
< 0:1.0.28-14.el8_8 Fix: upgrade to 0:1.0.28-14.el8_8
|
| Red Hat:rhel_tus:8.8::appstream | redhat | libsndfile-utils |
< 0:1.0.28-14.el8_8 Fix: upgrade to 0:1.0.28-14.el8_8
|
| Red Hat:rhel_tus:8.8::appstream | redhat | libsndfile-utils-debuginfo |
< 0:1.0.28-14.el8_8 Fix: upgrade to 0:1.0.28-14.el8_8
|
Original advisory text
Red Hat Security Advisory: libsndfile security update
References
- https://access.redhat.com/errata/RHSA-2026:25227 Vendor Advisory
- https://access.redhat.com/security/updates/classification/#important Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2463856 Third Party Advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_25227.... Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-37555 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-37555 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-37555 Vendor Advisory
- https://github.com/libsndfile/libsndfile/commit/9a829113c88a51e57c1e46473e90609e... Third Party Advisory
- https://github.com/libsndfile/libsndfile/issues/833 Third Party Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published12 Jun 2026
Updated12 Jun 2026
First seen12 Jun 2026
Sources
RHSA-2026:25227 · OSV
Track software like this
Free during beta