CVE-2026-109828

MEDIUM 4.3

libsndfile WAV Parsing wavlike.c wavlike_subchunk_parse uninitialized variable

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was found in libsndfile up to 1.2.2. This issue affects the function wavlike_subchunk_parse of the file src/wavlike.c of the component WAV Parsing. Performing a manipulation results in use of uninitialized variable. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

CWE	CWE-457 CWE-453
Vendor	n/a
Product	libsndfile
Published	Oct 13, 2026
Last Updated	Oct 13, 2026

Stay Ahead of the Next One

Get instant alerts for n/a libsndfile

Be the first to know when new medium vulnerabilities affecting n/a libsndfile are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

n/a / libsndfile

1.2.0 1.2.1 1.2.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/417466 vuldb.com: https://vuldb.com/vuln/417466/cti vuldb.com: https://vuldb.com/cve/CVE-2026-109828 vuldb.com: https://vuldb.com/submit/1002209 github.com: https://github.com/libsndfile/libsndfile/issues/1169 github.com: https://github.com/libsndfile/libsndfile/

Credits

🔍 suyuanwang (VulDB User) VulDB CNA Team