CVE-2011-2696

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2011-07-27 · updated 2026-06-16
Weakness: CWE-119

Description

Integer overflow in libsndfile before 1.0.25 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PARIS Audio Format (PAF) file that triggers a heap-based buffer overflow.

Affected products

Mega-Nerd Libsndfile: through 1.0.24; 0.0.8, 0.0.28, 1.0.0, 1.0.0-rc1, 1.0.0-rc6, 1.0.1 (+22)

References

http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062955.html
http://secunia.com/advisories/45125
http://secunia.com/advisories/45351
http://secunia.com/advisories/45384
http://secunia.com/advisories/45388
http://secunia.com/advisories/45433
http://www.debian.org/security/2011/dsa-2288
http://www.mandriva.com/security/advisories?name=MDVSA-2011:119
http://www.mega-nerd.com/libsndfile/ChangeLog
http://www.openwall.com/lists/oss-security/2011/07/14/1
http://www.openwall.com/lists/oss-security/2011/07/14/2
http://www.openwall.com/lists/oss-security/2011/07/14/3

Get alerted when CVE-2011-2696 or the next vulnerability affects your stack