---
id: CVE-2026-109828
title: A vulnerability was found in libsndfile up to 1.2.2
summary: >-
  A vulnerability was found in libsndfile up to 1.2.2. This issue affects the
  function wavlike_subchunk_parse of the file src/wavlike.c of the component WAV
  Parsing. Performing a manipulation results in use of uninitialized variable.
  Remot…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N'
cwe:
  - CWE-453
  - CWE-457
  - CWE-908
published: '2026-10-13'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T19:26:24.643'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-109828'
references:
  - url: 'https://github.com/libsndfile/libsndfile/'
    label: cna@vuldb.com
  - url: 'https://github.com/libsndfile/libsndfile/issues/1169'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/cve/CVE-2026-109828'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/submit/1002209'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/417466'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/417466/cti'
    label: cna@vuldb.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-109828.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-109828'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2550711'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-109828'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-109828'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
  - cve.org
  - exploit-available
ingestedAt: '2026-10-13T17:38:53.181Z'
vendor: Red Hat
product: Red Hat Enterprise Linux 10
affected:
  - enterprise_linux 10
  - enterprise_linux 6
  - enterprise_linux 7
  - enterprise_linux 8
  - enterprise_linux 9
  - enterprise_linux_ai_rhel_ai 3
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-13T17:15:52.546585Z'
epss: 0.00293
epssPercentile: 0.21818
---

## Overview

A vulnerability was found in libsndfile up to 1.2.2. This issue affects the function wavlike_subchunk_parse of the file src/wavlike.c of the component WAV Parsing. Performing a manipulation results in use of uninitialized variable. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux AI (RHEL AI) 3 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, … · updated 2026-10-13 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-109828.json)