CVE-2026-88386MediumCVSS 5.5

libsndfile 1.2.2 contains a misaligned memory access issue in psf_binheader_readf() while parsing WAV fmt chunks. A specially crafted WAV file can cause the function to cast an unaligned destination address to unsigned int * and perform a 4-byte store. This results in undefined behavior leading to denial of service.

Published
October 9, 2026
Last Modified
—

🔗 CVE IDs covered (1)

🎯 Affected products1

  • azl3 libsndfile 1.2.2-5 on Azure Linux 3.0

✅ Remediation

KBRelease Notes (Security Update) — fixed build 1.2.2-6

🔗 References (2)