{"id":"CVE-2022-33064","aliases":["AZL-28506","AZL-34939","DEBIAN-CVE-2022-33064","EUVD-2022-36121","GHSA-6g97-p9mv-cpgv","ROOT-OS-DEBIAN-12-CVE-2022-33064","UBUNTU-CVE-2022-33064"],"status":"published","title":"An off-by-one error in function wav_read_header in src/wav.c in Libsndfile 1.1.0, results in a...","description":"An off-by-one error in function wav_read_header in src/wav.c in Libsndfile 1.1.0, results in a write out of bound, which allows an attacker to execute arbitrary code, Denial of Service or other unspecified impacts.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00338,"percentile":0.27509,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-193"],"published":"2023-07-18T00:00:00Z","modified":"2026-10-28T02:30:38Z","fixes":[{"ecosystem":"Azure Linux:3","package":"libsndfile","fixed_in":["1.2.2-1"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"libsndfile","fixed_in":["1.2.0-1+deb12u1.aikido.5","1.2.0-1+deb12u1.root.io.4","1.2.0-1+deb12u1.aikido.6"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-libsndfile","fixed_in":["1.2.0-1+deb12u1.aikido.5","1.2.0-1+deb12u1.root.io.4","1.2.0-1+deb12u1.aikido.6"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.0.31-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-1"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-1+deb12u1.aikido.5"},{"fixed":"1.2.0-1+deb12u1.root.io.4"},{"fixed":"1.2.0-1+deb12u1.aikido.6"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-1+deb12u1.aikido.5"},{"fixed":"1.2.0-1+deb12u1.root.io.4"},{"fixed":"1.2.0-1+deb12u1.aikido.6"}]}]}],"products":[{"vendor":"libsndfile_project","product":"libsndfile"}],"references":[{"url":"https://github.com/libsndfile/libsndfile/issues/832","tags":["x_transferred","Exploit","Issue Tracking","Patch","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-33064","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-6g97-p9mv-cpgv"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/33xxx/CVE-2022-33064.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-33064","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-33064","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-33064","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-33064","description":"An off-by-one error in function wav_read_header in src/wav.c in Libsndfile 1.1.0, results in a write out of bound, which allows an attacker to execute arbitrary code, Denial of Service or other unspecified impacts.","status":"published","published":"2023-07-18T00:00:00Z","modified":"2024-10-28T18:23:53.758Z","updated_at":"2026-11-02T14:34:40.621895Z"}],"euvd":[{"id":"EUVD-2022-36121","description":"An off-by-one error in function wav_read_header in src/wav.c in Libsndfile 1.1.0, results in a write out of bound, which allows an attacker to execute arbitrary code, Denial of Service or other unspecified impacts.","status":"published","published":"2023-07-18T00:00:00Z","modified":"2024-10-28T18:23:53Z","updated_at":"2026-11-03T00:05:16.135425Z"}],"ghsa":[{"id":"GHSA-6g97-p9mv-cpgv","title":"An off-by-one error in function wav_read_header in src/wav.c in Libsndfile 1.1.0, results in a...","description":"An off-by-one error in function wav_read_header in src/wav.c in Libsndfile 1.1.0, results in a write out of bound, which allows an attacker to execute arbitrary code, Denial of Service or other unspecified impacts.","status":"published","published":"2023-07-18T15:30:36Z","modified":"2024-04-04T06:13:34Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-193"],"updated_at":"2026-11-02T14:56:40.370348Z"}],"nvd":[{"id":"CVE-2022-33064","description":"An off-by-one error in function wav_read_header in src/wav.c in Libsndfile 1.1.0, results in a write out of bound, which allows an attacker to execute arbitrary code, Denial of Service or other unspecified impacts.","status":"published","published":"2023-07-18T14:15:11.973Z","modified":"2026-06-17T04:48:25.573Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-193"],"updated_at":"2026-11-02T14:07:38.721429Z"}],"osv":[{"id":"AZL-28506","title":"CVE-2022-33064 affecting package libsndfile 1.0.31-4","description":"An off-by-one error in function wav_read_header in src/wav.c in Libsndfile 1.1.0, results in a write out of bound, which allows an attacker to execute arbitrary code, Denial of Service or other unspecified impacts.","status":"published","published":"2023-07-18T14:15:11Z","modified":"2026-04-21T04:25:51.102549Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:03.46006Z"},{"id":"AZL-34939","title":"CVE-2022-33064 affecting package libsndfile for versions less than 1.2.2-1","description":"An off-by-one error in function wav_read_header in src/wav.c in Libsndfile 1.1.0, results in a write out of bound, which allows an attacker to execute arbitrary code, Denial of Service or other unspecified impacts.","status":"published","published":"2023-07-18T14:15:11Z","modified":"2026-04-21T04:55:35.30401Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:03.821827Z"},{"id":"DEBIAN-CVE-2022-33064","description":"An off-by-one error in function wav_read_header in src/wav.c in Libsndfile 1.1.0, results in a write out of bound, which allows an attacker to execute arbitrary code, Denial of Service or other unspecified impacts.","status":"withdrawn","published":"2023-07-18T14:15:11Z","modified":"2025-11-11T19:47:26.532643Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:37.256283Z"},{"id":"UBUNTU-CVE-2022-33064","description":"An off-by-one error in function wav_read_header in src/wav.c in Libsndfile 1.1.0, results in a write out of bound, which allows an attacker to execute arbitrary code, Denial of Service or other unspecified impacts.","status":"withdrawn","published":"2023-07-18T14:15:00Z","modified":"2026-01-06T09:20:15.884985Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:54.697021Z"},{"id":"CVE-2022-33064","description":"An off-by-one error in function wav_read_header in src/wav.c in Libsndfile 1.1.0, results in a write out of bound, which allows an attacker to execute arbitrary code, Denial of Service or other unspecified impacts.","status":"published","published":"2023-07-18T00:00:00Z","modified":"2026-10-28T02:30:38.687641926Z","updated_at":"2026-11-02T15:44:25.860945Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2022-33064","title":"CVE-2022-33064 in libsndfile - Patched by Root","description":"Root has patched CVE-2022-33064 in the libsndfile package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-09-11T08:03:47Z","modified":"2026-09-11T09:15:05.917681468Z","updated_at":"2026-11-02T15:53:30.70924Z"}]}}