CVE-2026-37555

Name of the Vulnerable Software and Affected Versions libsndfile version 1.2.2

Description An integer overflow exists in the IMA ADPCM codec within the WAV and close code paths. When the product of samplesperblock and blocks exceeds the maximum value of a 32-bit signed integer (INT MAX), a multiplication overflow occurs before the result is assigned to sf.frames. Because both samplesperblock and blocks are attacker-controlled values sourced from the WAV file header, this can lead to an incorrect frame count, resulting in a heap buffer overflow or denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.