AZL-109770
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-109770.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-109770
- Upstream
- Published
- 2026-10-15T19:17:30Z
- Modified
- 2026-10-26T05:31:35Z
- Summary
- CVE-2026-111157 affecting package sox 14.4.2.0-34
- Details
-
SoX through 14.4.2 contains a heap out-of-bounds write vulnerability in lsx_ms_adpcm_block_expand_i() in src/adpcm.c, triggered by an odd samplesPerBlock value in the WAV fmt chunk. Attackers can supply a crafted MS ADPCM WAV file to sox or any libsox consumer to write a partially controlled 16-bit sample past the heap buffer allocated by wav_ms_adpcm_fmt().
- References