CVE-2026-37555

Name	CVE-2026-37555
Description	An issue was discovered in libsndfile 1.2.2 IMA ADPCM codec. The AIFF code path (line 241) was fixed with (sf_count_t) cast, but the WAV code path (line 235) and close path (line 167) were not. When samplesperblock (int) * blocks (int) exceeds INT_MAX, the 32-bit multiplication overflows before being assigned to sf.frames (sf_count_t/int64). With samplesperblock=50000 and blocks=50000, the product 2500000000 overflows to -1794967296. This causes incorrect frame count leading to heap buffer overflow or denial of service. Both values come from the WAV file header and are attacker-controlled. This issue was discovered after an incomplete fix for CVE-2022-33065.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1135346

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libsndfile (PTS)	bullseye	1.0.31-2	vulnerable
	bullseye (security)	1.0.31-2+deb11u2	vulnerable
	bookworm	1.2.0-1+deb12u1	vulnerable
	trixie	1.2.2-2+deb13u1	vulnerable
	forky, sid	1.2.2-4	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libsndfile	source	(unstable)	(unfixed)			1135346

Notes

[trixie] - libsndfile <no-dsa> (Minor issue)
[bookworm] - libsndfile <postponed> (Minor issue, revisit when fixed upstream)
[bullseye] - libsndfile <postponed> (Minor issue; can be fixed in next update)
https://www.openwall.com/lists/oss-security/2026/04/30/7
CVE exists because of an incomplte fix for CVE-2022-33065.
https://github.com/libsndfile/libsndfile/issues/1120
https://github.com/libsndfile/libsndfile/pull/1123
Fixed by: https://github.com/libsndfile/libsndfile/commit/c32c090ff9bb45e1dae637957c9c9b47b3967623