CVE-2018-13440

Name of the Vulnerable Software and Affected Versions The audiofile Audio File Library version 0.3.6

Description The issue is related to a NULL pointer dereference bug in the ModuleState::setup function, located in modules/ModuleState.cpp. This bug can be exploited by an attacker to cause a denial of service using a crafted caf file. An example of such exploitation is demonstrated by the sfconvert tool.

Recommendations For The audiofile Audio File Library version 0.3.6, consider restricting access to the ModuleState::setup function in modules/ModuleState.cpp to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using crafted caf files that could trigger the NULL pointer dereference bug. At the moment, there is no information about a newer version that contains a fix for this vulnerability.