Every CVE Search/ Get API key

CVE-2026-111157

SoX through 14.4.2 Heap Out-of-Bounds Write via MS ADPCM WAV Decoding

6.9 Medium

SoX through 14.4.2 contains a heap out-of-bounds write vulnerability in lsx_ms_adpcm_block_expand_i() in src/adpcm.c, triggered by an odd samplesPerBlock value in the WAV fmt chunk. Attackers can supply a crafted MS ADPCM WAV file to sox or any libsox consumer to write a partially controlled 16-bit sample past the heap buffer allocated by wav_ms_adpcm_fmt().

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Passive

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
High

Exploit likelihood

0.13%Unchanged since Oct 16, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.9

SoX through 14.4.2 Heap Out-of-Bounds Write via MS ADPCM WAV Decoding

SoX through 14.4.2 contains a heap out-of-bounds write vulnerability in lsx_ms_adpcm_block_expand_i() in src/adpcm.c, triggered by an odd samplesPerBlock value in the WAV fmt chunk. Attackers can supply a crafted MS ADPCM WAV file to sox or any libsox consumer to write a partially controlled 16-bit sample past the heap buffer allocated by wav_ms_adpcm_fmt().

Record
CVE-2026-111157
CVSS 4.0
6.9 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Weakness
CWE-787
Updated
2026-11-02
EUVDEUVD-2026-102284 6.9

SoX through 14.4.2 contains a heap out-of-bounds write vulnerability in lsx_ms_adpcm_block_expand_i() in src/adpcm.c, triggered by an odd samplesPerBlock value in the WAV fmt chunk. Attackers can supply a crafted MS ADPCM WAV file to sox or any libsox consumer to write a partially controlled 16-bit sample past the heap buffer allocated by wav_ms_adpcm_fmt().

Record
EUVD-2026-102284
CVSS 4.0
6.9 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-c49g-67hx-w7g2 6.9

SoX through 14.4.2 contains a heap out-of-bounds write vulnerability in...

SoX through 14.4.2 contains a heap out-of-bounds write vulnerability in lsx_ms_adpcm_block_expand_i() in src/adpcm.c, triggered by an odd samplesPerBlock value in the WAV fmt chunk. Attackers can supply a crafted MS ADPCM WAV file to sox or any libsox consumer to write a partially controlled 16-bit sample past the heap buffer allocated by wav_ms_adpcm_fmt().

Record
GHSA-c49g-67hx-w7g2
CVSS 4.0
6.9 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Weakness
CWE-787
Updated
2026-11-02
NVD 6.9

SoX through 14.4.2 contains a heap out-of-bounds write vulnerability in lsx_ms_adpcm_block_expand_i() in src/adpcm.c, triggered by an odd samplesPerBlock value in the WAV fmt chunk. Attackers can supply a crafted MS ADPCM WAV file to sox or any libsox consumer to write a partially controlled 16-bit sample past the heap buffer allocated by wav_ms_adpcm_fmt().

Record
CVE-2026-111157
CVSS 4.0
6.9 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Weakness
CWE-787
Updated
2026-11-02
OSV 6.9

SoX through 14.4.2 Heap Out-of-Bounds Write via MS ADPCM WAV Decoding

SoX through 14.4.2 contains a heap out-of-bounds write vulnerability in lsx_ms_adpcm_block_expand_i() in src/adpcm.c, triggered by an odd samplesPerBlock value in the WAV fmt chunk. Attackers can supply a crafted MS ADPCM WAV file to sox or any libsox consumer to write a partially controlled 16-bit sample past the heap buffer allocated by wav_ms_adpcm_fmt().

Record
CVE-2026-111157
CVSS 4.0
6.9 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-787
Updated
2026-11-02
OSVDEBIAN-CVE-2026-111157 6.9

SoX through 14.4.2 contains a heap out-of-bounds write vulnerability in lsx_ms_adpcm_block_expand_i() in src/adpcm.c, triggered by an odd samplesPerBlock value in the WAV fmt chunk. Attackers can supply a crafted MS ADPCM WAV file to sox or any libsox consumer to write a partially controlled 16-bit sample past the heap buffer allocated by wav_ms_adpcm_fmt().

Record
DEBIAN-CVE-2026-111157
CVSS 4.0
6.9 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVUBUNTU-CVE-2026-111157 6.9

SoX through 14.4.2 contains a heap out-of-bounds write vulnerability in lsx_ms_adpcm_block_expand_i() in src/adpcm.c, triggered by an odd samplesPerBlock value in the WAV fmt chunk. Attackers can supply a crafted MS ADPCM WAV file to sox or any libsox consumer to write a partially controlled 16-bit sample past the heap buffer allocated by wav_ms_adpcm_fmt().

Record
UBUNTU-CVE-2026-111157
CVSS 4.0
6.9 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Updated
2026-11-02
OSVAZL-109770 No score

CVE-2026-111157 affecting package sox 14.4.2.0-34

SoX through 14.4.2 contains a heap out-of-bounds write vulnerability in lsx_ms_adpcm_block_expand_i() in src/adpcm.c, triggered by an odd samplesPerBlock value in the WAV fmt chunk. Attackers can supply a crafted MS ADPCM WAV file to sox or any libsox consumer to write a partially controlled 16-bit sample past the heap buffer allocated by wav_ms_adpcm_fmt().

Record
AZL-109770
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
sox
Azure Linux:3
 through 14.4.2.0-34 None known
sox
Debian:12
 All versions, plus listed versions
14.4.2+git20190427-3.514.4.2+git20190427-414.4.2+git20190427-5
 None known
sox
Debian:13
 All versions, plus listed versions
14.4.2+git20190427-5
 None known
sox
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
14.4.1-314.4.1-3ubuntu114.4.1-3ubuntu1.114.4.1-3ubuntu1.1+esm114.4.1-3ubuntu1.1+esm214.4.1-3ubuntu1.1+esm314.4.1-3ubuntu1.1+esm4
 None known
sox
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
14.4.1-514.4.1-5ubuntu0.114.4.1-5ubuntu0.1+esm114.4.1-5+deb8u4ubuntu0.114.4.1-5+deb8u4ubuntu0.1+esm114.4.1-5+deb8u4ubuntu0.1+esm214.4.1-5+deb8u4ubuntu0.1+esm3
 None known
sox
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
14.4.1-5build114.4.2-214.4.2-314.4.2-3ubuntu0.1~esm114.4.2-3ubuntu0.18.04.114.4.2-3ubuntu0.18.04.214.4.2-3ubuntu0.18.04.314.4.2-3ubuntu0.18.04.3+esm1
 None known
sox
Ubuntu:20.04:LTS
 All versions, plus listed versions
14.4.2+git20190427-1build114.4.2+git20190427-214.4.2+git20190427-2+deb11u1build0.20.04.114.4.2+git20190427-2+deb11u2build0.20.04.114.4.2+git20190427-2+deb11u2ubuntu0.20.04.1
 None known
sox
Ubuntu:22.04:LTS
 All versions, plus listed versions
14.4.2+git20190427-214.4.2+git20190427-2+deb11u1build0.22.04.114.4.2+git20190427-2+deb11u2build0.22.04.114.4.2+git20190427-2+deb11u2ubuntu0.22.04.1
 None known
sox
Ubuntu:24.04:LTS
 All versions, plus listed versions
14.4.2+git20190427-3.514.4.2+git20190427-414.4.2+git20190427-4build214.4.2+git20190427-4build314.4.2+git20190427-4build4
 None known

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-111157 is a medium vulnerability (CVSS 6.9) in Chris Bagwell Sox, published October 15, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.13%, the 2nd percentile. No source names a fixed version.

References

Show 6 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open