#1149062 libsndfile: CVE-2026-88386

Package:
src:libsndfile
Source:
src:libsndfile
Submitter:
Salvatore Bonaccorso
Date:
2026-09-26 12:03:02 UTC
Severity:
normal
#1149062#5
Date:
2026-09-26 12:02:21 UTC
From:
To:
Hi,

The following vulnerability was published for libsndfile.

CVE-2026-88386[0]:
| libsndfile 1.2.2 contains a misaligned memory access issue in
| psf_binheader_readf() while parsing WAV fmt chunks. A specially
| crafted WAV file can cause the function to cast an unaligned
| destination address to unsigned int * and perform a 4-byte store.
| This results in undefined behavior leading to denial of service.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-88386
https://www.cve.org/CVERecord?id=CVE-2026-88386
[1] https://github.com/libsndfile/libsndfile/issues/1150
[2] https://github.com/libsndfile/libsndfile/commit/474e4d328b1e6240b93ec6ed14efb7c6a44bee57

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore