Hi,

The following vulnerability was published for libsndfile.

CVE-2026-109828[0]:
| A vulnerability was found in libsndfile up to 1.2.2. This issue
| affects the function wavlike_subchunk_parse of the file
| src/wavlike.c of the component WAV Parsing. Performing a
| manipulation results in use of uninitialized variable. Remote
| exploitation of the attack is possible. The exploit has been made
| public and could be used. The project was informed of the problem
| early through an issue report but has not responded yet.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-109828
https://www.cve.org/CVERecord?id=CVE-2026-109828
[1] https://github.com/libsndfile/libsndfile/issues/1169
[2] https://github.com/libsndfile/libsndfile/pull/1170

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore