CVE-2026-37555 Integer overflow in n/a
An integer overflow in libsndfile's WAV IMA ADPCM codec allows attackers to cause heap buffer overflows or denial of service via crafted files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-37555?
CVE-2026-37555 is a high-severity vulnerability in n/a, published on 29 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in libsndfile 1.2.2 IMA ADPCM codec. The AIFF code path (line 241) was fixed with (sf_count_t) cast, but the WAV code path (line 235) and close path (line 167) were not. When samplesperblock (int) * blocks (int) exceeds INT_MAX, the 32-bit multiplication overflows before being assigned to sf.frames (sf_count_t/int64). With samplesperblock=50000 and blocks=50000, the product 2500000000 overflows to -1794967296. This causes incorrect frame count leading to heap buffer overflow or denial of service. Both values come from the WAV file header and are attacker-controlled. This issue was discovered after an incomplete fix for CVE-2022-33065.
Weakness: CWE-190
Which versions are affected by CVE-2026-37555?
It affects 1 product.
Linux distribution packages (40)
libsndfile AlmaLinux:10 | All versions | 1.2.2-6.el10_2.1 |
libsndfile-devel AlmaLinux:10 | All versions | 1.2.2-6.el10_2.1 |
libsndfile-utils AlmaLinux:10 | All versions | 1.2.2-6.el10_2.1 |
libsndfile AlmaLinux:8 | All versions | 1.0.28-17.el8_10 |
libsndfile-devel AlmaLinux:8 | All versions | 1.0.28-17.el8_10 |
libsndfile-utils AlmaLinux:8 | All versions | 1.0.28-17.el8_10 |
libsndfile AlmaLinux:9 | All versions | 1.0.31-9.el9_8.1 |
libsndfile-devel AlmaLinux:9 | All versions | 1.0.31-9.el9_8.1 |
libsndfile-utils AlmaLinux:9 | All versions | 1.0.31-9.el9_8.1 |
libsndfile Red Hat:enterprise_linux:10.2 | All versions | 0:1.2.2-6.el10_2.1 |
libsndfile-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:1.2.2-6.el10_2.1 |
libsndfile-debugsource Red Hat:enterprise_linux:10.2 | All versions | 0:1.2.2-6.el10_2.1 |
libsndfile-devel Red Hat:enterprise_linux:10.2 | All versions | 0:1.2.2-6.el10_2.1 |
libsndfile-utils Red Hat:enterprise_linux:10.2 | All versions | 0:1.2.2-6.el10_2.1 |
libsndfile-utils-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:1.2.2-6.el10_2.1 |
libsndfile Red Hat:enterprise_linux:8::appstream | All versions | 0:1.0.28-17.el8_10 |
libsndfile-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.0.28-17.el8_10 |
libsndfile-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:1.0.28-17.el8_10 |
libsndfile-utils Red Hat:enterprise_linux:8::appstream | All versions | 0:1.0.28-17.el8_10 |
libsndfile-utils-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.0.28-17.el8_10 |
libsndfile-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:1.0.28-17.el8_10 |
libsndfile-debugsource Red Hat:enterprise_linux:8::crb | All versions | 0:1.0.28-17.el8_10 |
libsndfile-devel Red Hat:enterprise_linux:8::crb | All versions | 0:1.0.28-17.el8_10 |
libsndfile-utils-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:1.0.28-17.el8_10 |
libsndfile Red Hat:enterprise_linux:9::appstream | All versions | 0:1.0.31-9.el9_8.1 |
libsndfile-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:1.0.31-9.el9_8.1 |
libsndfile-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:1.0.31-9.el9_8.1 |
libsndfile-utils Red Hat:enterprise_linux:9::appstream | All versions | 0:1.0.31-9.el9_8.1 |
libsndfile-utils-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:1.0.31-9.el9_8.1 |
libsndfile-debuginfo Red Hat:enterprise_linux:9::crb | All versions | 0:1.0.31-9.el9_8.1 |
libsndfile-debugsource Red Hat:enterprise_linux:9::crb | All versions | 0:1.0.31-9.el9_8.1 |
libsndfile-devel Red Hat:enterprise_linux:9::crb | All versions | 0:1.0.31-9.el9_8.1 |
libsndfile-utils-debuginfo Red Hat:enterprise_linux:9::crb | All versions | 0:1.0.31-9.el9_8.1 |
libsndfile Red Hat:enterprise_linux_eus:10.0 | All versions | 0:1.2.2-5.el10_0.1 |
libsndfile-debuginfo Red Hat:enterprise_linux_eus:10.0 | All versions | 0:1.2.2-5.el10_0.1 |
libsndfile-debugsource Red Hat:enterprise_linux_eus:10.0 | All versions | 0:1.2.2-5.el10_0.1 |
libsndfile-devel Red Hat:enterprise_linux_eus:10.0 | All versions | 0:1.2.2-5.el10_0.1 |
libsndfile-utils Red Hat:enterprise_linux_eus:10.0 | All versions | 0:1.2.2-5.el10_0.1 |
libsndfile-utils-debuginfo Red Hat:enterprise_linux_eus:10.0 | All versions | 0:1.2.2-5.el10_0.1 |
libsndfile Red Hat:rhel_aus:8.4::appstream | All versions | 0:1.0.28-10.el8_4.2 |
Products include Libsndfile Project Libsndfile.
How do I fix CVE-2026-37555?
Apply the vendor's patch.
Is CVE-2026-37555 being exploited?
There is no known exploitation of CVE-2026-37555 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as ALSA-2026:19559, ALSA-2026:19560, ALSA-2026:19610, AZL-85457, CLSA-2026-1780515309, CLSA-2026-1780592196 and 21 more.