CVE-2026-111157
MediumCVSS 6.1Summary
SoX through 14.4.2 contains a heap out-of-bounds write vulnerability in lsx_ms_adpcm_block_expand_i() in src/adpcm.c, triggered by an odd samplesPerBlock value in the WAV fmt chunk. Attackers can supply a crafted MS ADPCM WAV file to sox or any libsox consumer to write a partially controlled 16-bit sample past the heap buffer allocated by wav_ms_adpcm_fmt().
Risk Assessment
The vulnerability can lead to heap memory corruption, application crashes, and potentially arbitrary code execution. The risk affects applications processing untrusted MS ADPCM WAV files.
Recommendation
Update SoX to a version newer than 14.4.2 if available, or avoid processing untrusted MS ADPCM WAV files. Consider validating samplesPerBlock values before processing.
Other vulnerabilities in SoX
See all- CVE-2023-34432High
A heap buffer overflow vulnerability was found in sox, in the lsx_readbuf function. This flaw can lead to denial of service, code execution, or information disclosure.
- CVE-2023-34318High
A heap buffer overflow vulnerability was found in sox, in the startread function. This flaw can lead to denial of service, code execution, or information disclosure.
Original NVD description (English source)
SoX through 14.4.2 contains a heap out-of-bounds write vulnerability in lsx_ms_adpcm_block_expand_i() in src/adpcm.c, triggered by an odd samplesPerBlock value in the WAV fmt chunk. Attackers can supply a crafted MS ADPCM WAV file to sox or any libsox consumer to write a partially controlled 16-bit sample past the heap buffer allocated by wav_ms_adpcm_fmt().
Vulnerability data from NVD (NIST) · CISA KEV · EPSS