{"id":"CVE-2024-50613","aliases":["AZL-51909","AZL-51977","BELL-CVE-2024-50613","DEBIAN-CVE-2024-50613","EUVD-2024-44976","GHSA-425f-273g-699h","ROOT-OS-DEBIAN-12-CVE-2024-50613","UBUNTU-CVE-2024-50613"],"status":"published","title":"libsndfile through 1.2.2 has a reachable assertion, that may lead to application exit, in...","description":"libsndfile through 1.2.2 has a reachable assertion, that may lead to application exit, in mpeg_l3_encode.c mpeg_l3_encoder_close.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.0054,"percentile":0.45888,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-617"],"published":"2024-10-27T00:00:00Z","modified":"2026-11-06T13:50:44Z","fixes":[{"ecosystem":"Root:Debian:12","package":"libsndfile","fixed_in":["1.2.0-1+deb12u1.root.io.3","1.2.0-1+deb12u1.aikido.5","1.2.0-1+deb12u1.root.io.4","1.2.0-1+deb12u1.aikido.6"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-libsndfile","fixed_in":["1.2.0-1+deb12u1.root.io.3","1.2.0-1+deb12u1.aikido.5","1.2.0-1+deb12u1.root.io.4","1.2.0-1+deb12u1.aikido.6"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.2.2-7"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.0.31-4"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0-r2"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.0-r1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.0-1","1.2.0-1+deb12u1","1.2.2-1","1.2.2-1+hurd.1","1.2.2-1+hurd.2","1.2.2-1+hurd.3","1.2.2-2","1.2.2-3","1.2.2-4"]},{"source":"osv","ecosystem":"Debian:13","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.2-2","1.2.2-2+deb13u1","1.2.2-3","1.2.2-4"]},{"source":"osv","ecosystem":"Debian:14","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.2-2","1.2.2-3","1.2.2-4"]},{"source":"osv","ecosystem":"Root:Debian:12","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-1+deb12u1.root.io.3"},{"fixed":"1.2.0-1+deb12u1.aikido.5"},{"fixed":"1.2.0-1+deb12u1.root.io.4"},{"fixed":"1.2.0-1+deb12u1.aikido.6"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-1+deb12u1.root.io.3"},{"fixed":"1.2.0-1+deb12u1.aikido.5"},{"fixed":"1.2.0-1+deb12u1.root.io.4"},{"fixed":"1.2.0-1+deb12u1.aikido.6"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.25-7ubuntu1","1.0.25-7ubuntu2","1.0.25-7ubuntu2.1","1.0.25-7ubuntu2.2","1.0.25-7ubuntu2.2+esm1","1.0.25-7ubuntu2.2+esm2","1.0.25-7ubuntu2.2+esm3","1.0.25-7ubuntu2.2+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.25-9.1","1.0.25-10","1.0.25-10ubuntu0.16.04.1","1.0.25-10ubuntu0.16.04.2","1.0.25-10ubuntu0.16.04.3","1.0.25-10ubuntu0.16.04.3+esm1","1.0.25-10ubuntu0.16.04.3+esm2","1.0.25-10ubuntu0.16.04.3+esm3","1.0.25-10ubuntu0.16.04.3+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.28-4","1.0.28-4ubuntu0.18.04.1","1.0.28-4ubuntu0.18.04.2","1.0.28-4ubuntu0.18.04.2+esm1","1.0.28-4ubuntu0.18.04.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.28-6","1.0.28-7","1.0.28-7ubuntu0.1","1.0.28-7ubuntu0.2","1.0.28-7ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.2-1","1.2.2-1ubuntu2","1.2.2-1ubuntu3","1.2.2-1ubuntu4","1.2.2-1ubuntu5","1.2.2-1ubuntu5.24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.2-2build1","1.2.2-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.2-4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libsndfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.2-3","1.2.2-4"]}],"products":[{"vendor":"libsndfile_project","product":"libsndfile"}],"references":[{"url":"https://github.com/libsndfile/libsndfile/issues/1034","tags":["Exploit","Third Party Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50613","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-425f-273g-699h"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-50613","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50613.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-50613","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-50613","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-50613","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-50613","description":"libsndfile through 1.2.2 has a reachable assertion, that may lead to application exit, in mpeg_l3_encode.c mpeg_l3_encoder_close.","status":"published","published":"2024-10-27T00:00:00Z","modified":"2024-10-30T19:13:18.634Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-617"],"updated_at":"2026-11-02T14:34:22.153872Z"}],"euvd":[{"id":"EUVD-2024-44976","description":"libsndfile through 1.2.2 has a reachable assertion, that may lead to application exit, in mpeg_l3_encode.c mpeg_l3_encoder_close.","status":"published","published":"2024-10-27T00:00:00Z","modified":"2024-10-30T19:13:18Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T00:05:13.91882Z"}],"ghsa":[{"id":"GHSA-425f-273g-699h","title":"libsndfile through 1.2.2 has a reachable assertion, that may lead to application exit, in...","description":"libsndfile through 1.2.2 has a reachable assertion, that may lead to application exit, in mpeg_l3_encode.c mpeg_l3_encoder_close.","status":"published","published":"2024-10-28T00:30:48Z","modified":"2024-10-30T21:31:41Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-617"],"updated_at":"2026-11-02T14:58:39.78243Z"}],"nvd":[{"id":"CVE-2024-50613","description":"libsndfile through 1.2.2 has a reachable assertion, that may lead to application exit, in mpeg_l3_encode.c mpeg_l3_encoder_close.","status":"published","published":"2024-10-27T22:15:03.66Z","modified":"2026-06-17T08:04:48.483Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-617"],"updated_at":"2026-11-02T14:10:34.877798Z"}],"osv":[{"id":"AZL-51909","title":"CVE-2024-50613 affecting package libsndfile 1.2.2-7","description":"libsndfile through 1.2.2 has a reachable assertion, that may lead to application exit, in mpeg_l3_encode.c mpeg_l3_encoder_close.","status":"published","published":"2024-10-27T22:15:03Z","modified":"2026-11-05T05:40:51Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-05T16:41:20.675084Z"},{"id":"AZL-51977","title":"CVE-2024-50613 affecting package libsndfile 1.0.31-4","description":"libsndfile through 1.2.2 has a reachable assertion, that may lead to application exit, in mpeg_l3_encode.c mpeg_l3_encoder_close.","status":"published","published":"2024-10-27T22:15:03Z","modified":"2026-04-21T04:33:18.664733Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:06.3228Z"},{"id":"BELL-CVE-2024-50613","status":"published","published":"2024-10-31T10:13:40.135935Z","modified":"2026-01-26T09:42:41.536396Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:20.963569Z"},{"id":"CVE-2024-50613","description":"libsndfile through 1.2.2 has a reachable assertion, that may lead to application exit, in mpeg_l3_encode.c mpeg_l3_encoder_close.","status":"published","published":"2024-10-27T00:00:00Z","modified":"2026-10-28T02:30:25.955780951Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:44.032344Z"},{"id":"DEBIAN-CVE-2024-50613","description":"libsndfile through 1.2.2 has a reachable assertion, that may lead to application exit, in mpeg_l3_encode.c mpeg_l3_encoder_close.","status":"published","published":"2024-10-27T22:15:03.66Z","modified":"2026-11-02T12:03:06.786096843Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:44.117337Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2024-50613","title":"CVE-2024-50613 in libsndfile - Patched by Root","description":"Root has patched CVE-2024-50613 in the libsndfile package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-09-11T08:03:47Z","modified":"2026-09-11T09:15:04.681039117Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:30.70924Z"},{"id":"UBUNTU-CVE-2024-50613","description":"libsndfile through 1.2.2 has a reachable assertion, that may lead to application exit, in mpeg_l3_encode.c mpeg_l3_encoder_close.","status":"published","published":"2024-10-27T22:15:00Z","modified":"2026-11-06T13:50:44.076334689Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-06T14:23:13.514158Z"}]}}