Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
libsndfile can execute code from crafted WAV files
published 5 years ago
Summary
The libsndfile library, used to read and write audio formats like WAV, can be tricked by a specially crafted file to overflow memory and run unwanted code. This affects systems using the libsndfile packages from AlmaLinux. Update libsndfile to the latest version to eliminate the risk.
What to do
- Update almalinux libsndfile to version 1.0.28-10.el8_4.1.
- Update almalinux libsndfile-devel to version 1.0.28-10.el8_4.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| AlmaLinux:8 | almalinux | libsndfile |
< 1.0.28-10.el8_4.1 Fix: upgrade to 1.0.28-10.el8_4.1
|
| AlmaLinux:8 | almalinux | libsndfile-devel |
< 1.0.28-10.el8_4.1 Fix: upgrade to 1.0.28-10.el8_4.1
|
Original advisory text
Important: libsndfile security update
libsndfile is a C library for reading and writing files containing sampled sound, such as AIFF, AU, or WAV.
Security Fix(es):
* libsndfile: Heap buffer overflow via crafted WAV file allows arbitrary code execution (CVE-2021-3246)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* libsndfile: Heap buffer overflow via crafted WAV file allows arbitrary code execution (CVE-2021-3246)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://vulners.com/cve/CVE-2021-3246 Third Party Advisory
Timeline
Published24 Aug 2021
Updated29 Oct 2026
First seen29 Oct 2026
Sources
ALSA-2021:3253 · OSV
Track software like this
Free during beta