What’s Vulnerable › Vulnerabilities

CVE-2026-88386

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-24 · updated 2026-09-25
• Weakness: CWE-122

Description

libsndfile 1.2.2 contains a misaligned memory access issue in psf_binheader_readf() while parsing WAV fmt chunks. A specially crafted WAV file can cause the function to cast an unaligned destination address to unsigned int * and perform a 4-byte store. This results in undefined behavior leading to denial of service.

References

• https://github.com/libsndfile/libsndfile/issues/1150
• https://github.com/mhlavink/libsndfileci/commit/474e4d328b1e6240b93ec6ed14efb7c6a44bee57
• https://github.com/libsndfile/libsndfile/issues/1150

Get alerted when CVE-2026-88386 or the next vulnerability affects your stack